Time-Based SQL Injection in Cost Calculator Builder Plugin for WordPress
CVE-2025-2128
6.5MEDIUM
Summary
The Cost Calculator Builder plugin for WordPress is susceptible to a time-based SQL Injection through the 'order_ids' parameter, affecting all versions up to and including 3.2.67. This vulnerability arises from inadequate escaping of user-supplied input and poor SQL query preparation, allowing attackers with Subscriber-level access and higher to inject additional SQL queries. Such actions can lead to unauthorized access to sensitive information within the database, highlighting the importance of securing this plugin.
Affected Version(s)
Cost Calculator Builder * <= 3.2.67
References
CVSS V3.1
Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Michael Mazzolini