Authenticated Local File Inclusion (LFI) vulnerability discovered by apple502j in WordPress Cost Calculator plugin (versions <= 1.6).
Deactivate and delete. This plugin has been closed as of November 3, 2021 and is not available for download. Reason: Security Issue.