title: Cost Calculator <= 1.6 - Authenticated Local File Inclusion
description: The Cost Calculator WordPress plugin through 1.6 allows authenticated users (Contributor+ in versions < 1.5, and Admin+ in versions <= 1.6) to perform path traversal and local PHP file inclusion on Windows Web Servers via the Cost Calculator post's Layout
problem types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
affected:
{
product: Cost Calculator
vendor: Unknown
versions:
lessThanOrEqual: 1.6, status: affected, version: 1.6, versionType: custom
}