CVE-2025-62049
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The Cost Calculator Builder plugin (Stylemix) up to version 3.5.32 has a Missing Authorization vulnerability. This means unauthorized users may gain access to functions that should be protected.
Risk Assessment
The risk is the possibility of unauthorized access to plugin functions, which could lead to modification of settings or cost calculator data.
Recommendation
It is recommended to update the plugin to the latest version that fixes the issue and to review permission configuration.
Other vulnerabilities in Cost Calculator Builder
See all- CVE-2026-97307High
The Cost Calculator Builder plugin up to version 4.0.17 contains a vulnerability that inserts sensitive information into sent data, allowing retrieval of embedded sensitive data.
- CVE-2026-7753Medium
The Cost Calculator Builder plugin for WordPress up to version 3.6.17 is vulnerable to unauthorized access to sensitive data due to a missing capability check in the AJAX action `cost-calculator-custom-export-run`. The handler only verifies a nonce, which is available on every wp-admin page, allowing authenticated attackers with Subscriber-level access to export full calculator configurations, including Stripe, PayPal, Razorpay, webhook, and reCAPTCHA secret keys.
- CVE-2026-10865Medium
The Cost Calculator Builder plugin for WordPress up to version 4.0.11 exposes sensitive payment gateway credentials (Stripe, Razorpay, PayPal) in the page source. An unauthenticated attacker can extract these credentials when the 'use in all calculators' option is enabled for at least one payment gateway.
- CVE-2025-14755Medium
The Cost Calculator Builder plugin for WordPress (up to version 4.0.1) when used with the PRO version is vulnerable to unauthenticated price manipulation and Insecure Direct Object Reference (IDOR). An unauthenticated attacker can add WooCommerce products to the cart with attacker-controlled prices.
Original NVD description (English source)
Missing Authorization vulnerability in Stylemix Cost Calculator Builder cost-calculator-builder.This issue affects Cost Calculator Builder: from n/a through <= 3.5.32.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS