Cost Calculator Builder vulnerabilities

The Cost Calculator Builder plugin for WordPress up to version 3.6.17 is vulnerable to unauthorized access to sensitive data due to a missing capability check in the AJAX action `cost-calculator-custom-export-run`. The handler only verifies a nonce, which is available on every wp-admin page, allowing authenticated attackers with Subscriber-level access to export full calculator configurations, including Stripe, PayPal, Razorpay, webhook, and reCAPTCHA secret keys.

The Cost Calculator Builder plugin for WordPress up to version 4.0.11 exposes sensitive payment gateway credentials (Stripe, Razorpay, PayPal) in the page source. An unauthenticated attacker can extract these credentials when the 'use in all calculators' option is enabled for at least one payment gateway.

The Cost Calculator Builder plugin for WordPress (up to version 4.0.1) when used with the PRO version is vulnerable to unauthenticated price manipulation and Insecure Direct Object Reference (IDOR). An unauthenticated attacker can add WooCommerce products to the cart with attacker-controlled prices.