CVE-2025-12529 is a vulnerability in the stylemix Cost Calculator Builder WordPress plugin affecting all versions up to 3.6.3. The issue arises from insufficient validation of file paths in the deleteOrdersFiles() function, enabling unauthenticated attackers to inject arbitrary file paths for deletion when an administrator deletes orders. This can result in arbitrary file deletion, including critical files such as wp-config.php, potentially leading to remote code execution. Exploitation requires the presence of both the free and Pro versions of the plugin. The CVSS v3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated attackers to delete arbitrary files on the server hosting the WordPress site, including critical configuration files. This can lead to remote code execution and full compromise of the affected system. The vulnerability impacts confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider disabling or uninstalling the Cost Calculator Builder Pro plugin or avoid deleting orders via the plugin to prevent triggering the vulnerable function. Monitor vendor channels for updates and apply patches promptly once available.