Executive brief
The Cost Calculator Builder plugin for WordPress, which allows businesses to create custom price estimation forms, contains a security flaw when used with its Pro version. This vulnerability allows unauthorized individuals to manipulate the price of items in their shopping cart. This could lead to financial loss for the business if customers purchase products at significantly reduced, self-defined prices.
Technical details
The vulnerability stems from the 'ccb_woocommerce_payment' AJAX action being registered via 'wp_ajax_nopriv', which exposes it to unauthenticated users. The 'renderWooCommercePayment()' function fails to perform authorization checks and passes user-controlled data directly to 'CCBWooCheckout::init()'. An attacker can exploit this by sending a crafted AJAX request to modify product prices before they are added to the WooCommerce cart. This is classified as a Missing Authorization (CWE-862) issue and requires the PRO version of the plugin to be active.
Affected products
- StylemixThemes Cost Calculator Builder Up to and including 4.0.1
Timeline
- 2026-05-13: advisory: NVD published the vulnerability details.
References
- https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/3.6.7/includes/classes/CCBAjaxAction.php
- https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/3.6.7/includes/classes/CCBOrderController.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/fe684f43-8442-4b29-84a8-da8c6863e62b?source=cve