Time-Based SQL Injection in Cost Calculator Builder Plugin for WordPress

CVE-2025-2128

What is CVE-2025-2128?

The Cost Calculator Builder plugin for WordPress is susceptible to a time-based SQL Injection through the 'order_ids' parameter, affecting all versions up to and including 3.2.67. This vulnerability arises from inadequate escaping of user-supplied input and poor SQL query preparation, allowing attackers with Subscriber-level access and higher to inject additional SQL queries. Such actions can lead to unauthorized access to sensitive information within the database, highlighting the importance of securing this plugin.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References