Is CVE-2025-14755 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-14755 being exploited in the wild.

How severe is CVE-2025-14755?

Medium severity, with a CVSS score of 5.3, published 13 May 2026.

Which products and versions are affected?

StylemixThemes Cost Calculator Builder Up to and including 4.0.1.

Is there a fix for CVE-2025-14755?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-14755 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-14755?

Check whether you run StylemixThemes Cost Calculator Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-14755: StylemixThemes Cost Calculator Builder price manipulation via IDOR

CVE-2025-14755 · Severity: medium · CVSS 5.3 · Published 2026-05-13

The Cost Calculator Builder plugin for WordPress, which allows businesses to create custom price estimation forms, contains a security flaw when used with its Pro version. This vulnerability allows unauthorized individuals to manipulate the price of items in their shopping cart. This could lead to financial loss for the business if customers purchase products at significantly reduced, self-defined prices.

Technologies: StylemixThemes Cost Calculator Builder. Vendors: StylemixThemes.

Quick answers

Is CVE-2025-14755 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-14755 being exploited in the wild.
How severe is CVE-2025-14755?: Medium severity, with a CVSS score of 5.3, published 13 May 2026.
Which products and versions are affected?: StylemixThemes Cost Calculator Builder Up to and including 4.0.1.
Is there a fix for CVE-2025-14755?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-14755 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-14755?: Check whether you run StylemixThemes Cost Calculator Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability stems from the 'ccb_woocommerce_payment' AJAX action being registered via 'wp_ajax_nopriv', which exposes it to unauthenticated users. The 'renderWooCommercePayment()' function fails to perform authorization checks and passes user-controlled data directly to 'CCBWooCheckout::init()'. An attacker can exploit this by sending a crafted AJAX request to modify product prices before they are added to the WooCommerce cart. This is classified as a Missing Authorization (CWE-862) issue and requires the PRO version of the plugin to be active.

Affected products

StylemixThemes Cost Calculator Builder Up to and including 4.0.1

Timeline

2026-05-13: advisory: NVD published the vulnerability details.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.