Cost Calculator <= 1.8 - Authenticated Local File Inclusion

The plugin allows authenticated users (Contributor+ in versions < 1.5, and Admin+ in versions <= 1.8) to perform path traversal and local PHP file inclusion on Windows Web Servers via the Cost Calculator post’s Layout

PoC

As a contributor, create a Cost Calculator post, set the Layout to /…/…/…/…/…/…/…/…/…/…/file (assuming the file to include is at C:\xampp\file.php and WordPress is installed at C:\xampp\htdocs\wordpress). Save as draft, then embde the calculator using the related shortcode (e.g [nd_cost_calculator id=“806”]) and preview the post to trigger the LFI.