CVE-2026-10865
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
The Cost Calculator Builder plugin for WordPress up to version 4.0.11 exposes sensitive payment gateway credentials (Stripe, Razorpay, PayPal) in the page source. An unauthenticated attacker can extract these credentials when the 'use in all calculators' option is enabled for at least one payment gateway.
Risk Assessment
The risk is that an attacker can gain full control over the merchant's payment gateway accounts, potentially leading to fund theft, unauthorized transactions, and loss of customer trust.
Recommendation
Immediately update the Cost Calculator Builder plugin to the latest available version and disable the 'use in all calculators' option for payment gateways if not required. Additionally, reset and generate new secret keys for Stripe, Razorpay, and PayPal.
Other vulnerabilities in Cost Calculator Builder
See all- CVE-2026-7753Medium
The Cost Calculator Builder plugin for WordPress up to version 3.6.17 is vulnerable to unauthorized access to sensitive data due to a missing capability check in the AJAX action `cost-calculator-custom-export-run`. The handler only verifies a nonce, which is available on every wp-admin page, allowing authenticated attackers with Subscriber-level access to export full calculator configurations, including Stripe, PayPal, Razorpay, webhook, and reCAPTCHA secret keys.
- CVE-2025-14755Medium
The Cost Calculator Builder plugin for WordPress (up to version 4.0.1) when used with the PRO version is vulnerable to unauthenticated price manipulation and Insecure Direct Object Reference (IDOR). An unauthenticated attacker can add WooCommerce products to the cart with attacker-controlled prices.
Original NVD description (English source)
The Cost Calculator Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.11 via the (template body). This makes it possible for unauthenticated attackers to extract the plaintext Stripe secret key, Razorpay secret key, and PayPal client_secret embedded in the page source of any page containing a calculator, enabling full control of the merchant's payment gateway accounts. This exposure only occurs when the 'use in all calculators' option is enabled for one or more payment gateways in the plugin's global settings.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS