CVE-2026-14900

Received Received - Intake

Remote Code Execution in Cost Calculator Builder PRO WordPress Plugin

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: Wordfence

Description

The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.3 via the js_to_php function. This is due to insufficient sanitization of the orderDetails[*].originalValue field, which is injected verbatim into a calculator formula string passed to PHP eval() inside js_to_php(), with the regex allow-list in evaluateFormula() only filtering alphanumeric tokens and leaving non-word punctuation characters intact. This makes it possible for unauthenticated attackers to execute code on the server. The only authentication barrier is a nonce check, but the required nonce is publicly emitted on every front-end page via the wp_head hook, making it freely obtainable by unauthenticated visitors. Payloads must be non-word XOR gadgets to bypass sanitization.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-14900

Affected Vendors & Products

Vendor	Product	Version / Range
cost_calculator_builder_pro	cost_calculator_builder_pro	to 4.0.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability is a Remote Code Execution flaw in the Cost Calculator Builder PRO WordPress plugin up to version 4.0.3. It occurs because user input in the orderDetails[*].originalValue field is not properly sanitized before being passed to PHP's eval() function. Attackers can exploit this by injecting malicious code through non-word punctuation characters, bypassing weak sanitization. The vulnerability is accessible without authentication due to a publicly exposed nonce in wp_head.

Detection Guidance

Check if the Cost Calculator Builder PRO plugin version 4.0.3 or lower is installed on your WordPress site. Look for unauthorized code execution attempts in server logs, especially those involving eval() functions or unusual calculator formula strings.

Impact Analysis

This vulnerability allows unauthenticated attackers to execute arbitrary code on your server. This could lead to complete system compromise, data theft, website defacement, or use of your server for malicious activities like spam or further attacks. If your WordPress site uses this plugin, it is critically vulnerable and should be updated immediately.

Compliance Impact

This vulnerability could severely impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data. GDPR requires protection of personal data, and a breach could lead to fines. HIPAA mandates strict controls for health data; a compromise here would violate compliance. The flaw creates a high risk of data exposure and regulatory penalties.

Mitigation Strategies

Immediately update the Cost Calculator Builder PRO plugin to the latest version. If an update is not available, disable or remove the plugin entirely. Review server logs for signs of exploitation and consider implementing a web application firewall to block malicious requests.

Hi! I’m here to help you understand CVE-2026-14900. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70