CVE-2026-7753
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
The Cost Calculator Builder plugin for WordPress up to version 3.6.17 is vulnerable to unauthorized access to sensitive data due to a missing capability check in the AJAX action `cost-calculator-custom-export-run`. The handler only verifies a nonce, which is available on every wp-admin page, allowing authenticated attackers with Subscriber-level access to export full calculator configurations, including Stripe, PayPal, Razorpay, webhook, and reCAPTCHA secret keys.
Risk Assessment
Exposure of payment secret keys and other sensitive data can lead to financial theft, system integrity compromise, and user account takeover.
Recommendation
Update the Cost Calculator Builder plugin to the latest patched version. Additionally, restrict access to wp-admin pages for low-privileged users.
Other vulnerabilities in Cost Calculator Builder
See all- CVE-2026-10865Medium
The Cost Calculator Builder plugin for WordPress up to version 4.0.11 exposes sensitive payment gateway credentials (Stripe, Razorpay, PayPal) in the page source. An unauthenticated attacker can extract these credentials when the 'use in all calculators' option is enabled for at least one payment gateway.
- CVE-2025-14755Medium
The Cost Calculator Builder plugin for WordPress (up to version 4.0.1) when used with the PRO version is vulnerable to unauthenticated price manipulation and Insecure Direct Object Reference (IDOR). An unauthenticated attacker can add WooCommerce products to the cart with attacker-controlled prices.
Original NVD description (English source)
The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized access of sensitive data due to a missing capability check on the `cost-calculator-custom-export-run` AJAX action (handler `CCBExportImport::export_calculators()`) in all versions up to, and including, 3.6.17. The handler only verifies a nonce, but the corresponding `ccb_export_nonce` is broadcast on every wp-admin page (including pages reachable to Subscribers, such as `/wp-admin/profile.php`) by the `ccb_add_admin_nonces` callback hooked to `admin_head`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export every calculator's full configuration — including stored Stripe secret keys, PayPal client secrets, Razorpay secret keys, webhook secret keys, and reCAPTCHA secret keys.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS