Local File Inclusion Vulnerability in Wow-Company Calculator Builder
CVE-2025-26760

7.5HIGH

Key Information:

Vendor

WordPress
Status
Calculator Builder
Vendor
CVE Published:
22 February 2025

What is CVE-2025-26760?

The Wow-Company Calculator Builder is susceptible to a security flaw that allows local file inclusion due to improper control of filename parameters in PHP scripts. This vulnerability enables attackers to potentially access sensitive files on the server, posing a significant risk to the integrity and confidentiality of the web application. Affected versions include all up to and including 1.6.2, making it crucial for users to implement security measures and updates to mitigate potential exploit risks.

Affected Version(s)

Calculator Builder <= 1.6.2

References

https://patchstack.com/database/wordpress/plugin/calculat...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dimas Maulana (Patchstack Alliance)
.