The Cost Calculator Builder plugin for WordPress contains a flaw that lets an attacker delete any file on the server when an administrator removes order records. The flaw arises from insufficient path validation in the deleteOrdersFiles routine, which can be triggered by unauthenticated HTTP requests. If a critical file—such as the site’s configuration—is deleted, the attacker can achieve remote code execution by causing the application to load a controlled state or by dropping a malicious file into a writable directory.

WordPress installations running Cost Calculator Builder version 3.6.3 or earlier, with the Pro add‑on installed alongside the free plugin. Only environments that have both components are impacted, because the delete routine is exposed only when the Pro package is present.

The vulnerability is scored with a CVSS of 8.8, indicating high impact, but the EPSS score of less than 1 % suggests that it is seldom exploited in the wild. It is not listed in the CISA KEV catalogue. The attack path is simple: an unauthenticated user can craft a request that invokes the deleteOrdersFiles action, causing path traversal and deletion of arbitrary files. Successful exploitation could lead to loss of critical configuration data and subsequent execution of arbitrary code by the web server.