CVE-2024-6010

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-6010", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2024-06-14T16:33:02.308Z", "datePublished": "2024-09-07T11:17:06.172Z", "dateUpdated": "2026-04-08T17:34:39.215Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:34:39.215Z"}, "affected": [{"vendor": "StylemixThemes", "product": "Cost Calculator Builder PRO", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.2.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Cost Calculator Builder PRO plugin for WordPress is vulnerable to price manipulation in all versions up to, and including, 3.2.1. This is due to the plugin allowing the price field to be manipulated prior to processing via the 'create_cc_order' function, called from the Cost Calculator Builder plugin. This makes it possible for unauthenticated attackers to manipulate the price of orders submitted via the calculator. Note: this vulnerability was partially patched with the release of Cost Calculator Builder version 3.2.17."}], "title": "Cost Calculator Builder PRO <= 3.2.1 - Unauthenticated Price Manipulation", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fc04e676-e394-488e-a239-95af5f865613?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/cost-calculator-builder/trunk/frontend/dist/order.js"}, {"url": "https://docs.stylemixthemes.com/cost-calculator-builder/changelog-1/changelog-pro-version"}, {"url": "https://plugins.trac.wordpress.org/changeset/3172590/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-472 External Control of Assumed-Immutable Web Parameter", "cweId": "CWE-472", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "andrea bocchetti"}], "timeline": [{"time": "2024-09-06T23:09:21.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"affected": [{"vendor": "stylemixthemes", "product": "cost_calculator_builder_pro", "cpes": ["cpe:2.3:a:stylemixthemes:cost_calculator_builder_pro:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.2.1", "versionType": "semver"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-09T13:51:48.473910Z", "id": "CVE-2024-6010", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-28T20:59:59.935Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-6010", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-09T13:51:48.473910Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:stylemixthemes:cost_calculator_builder_pro:*:*:*:*:*:*:*:*"], "vendor": "stylemixthemes", "product": "cost_calculator_builder_pro", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.2.1"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-09T13:52:38.062Z"}}], "cna": {"title": "Cost Calculator Builder PRO <= 3.2.1 - Unauthenticated Price Manipulation", "credits": [{"lang": "en", "type": "finder", "value": "andrea bocchetti"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "StylemixThemes", "product": "Cost Calculator Builder PRO", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.2.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2024-09-06T23:09:21.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fc04e676-e394-488e-a239-95af5f865613?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/cost-calculator-builder/trunk/frontend/dist/order.js"}, {"url": "https://docs.stylemixthemes.com/cost-calculator-builder/changelog-1/changelog-pro-version"}, {"url": "https://plugins.trac.wordpress.org/changeset/3172590/"}], "descriptions": [{"lang": "en", "value": "The Cost Calculator Builder PRO plugin for WordPress is vulnerable to price manipulation in all versions up to, and including, 3.2.1. This is due to the plugin allowing the price field to be manipulated prior to processing via the 'create_cc_order' function, called from the Cost Calculator Builder plugin. This makes it possible for unauthenticated attackers to manipulate the price of orders submitted via the calculator. Note: this vulnerability was partially patched with the release of Cost Calculator Builder version 3.2.17."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-472", "description": "CWE-472 External Control of Assumed-Immutable Web Parameter"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:34:39.215Z"}}}, "cveMetadata": {"cveId": "CVE-2024-6010", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:34:39.215Z", "dateReserved": "2024-06-14T16:33:02.308Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2024-09-07T11:17:06.172Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Cost Calculator Builder PRO", "vendor": "StylemixThemes", "versions": [{"lessThanOrEqual": "3.2.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}, {"affectedData": [{"cpes": ["cpe:2.3:a:stylemixthemes:cost_calculator_builder_pro:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "cost_calculator_builder_pro", "vendor": "stylemixthemes", "versions": [{"lessThanOrEqual": "3.2.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:stylemixthemes:cost_calculator_builder:*:*:*:*:pro:wordpress:*:*", "matchCriteriaId": "5D654602-1087-45AE-9CED-37061ED664D9", "versionEndIncluding": "3.1.96", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Cost Calculator Builder PRO plugin for WordPress is vulnerable to price manipulation in all versions up to, and including, 3.2.1. This is due to the plugin allowing the price field to be manipulated prior to processing via the 'create_cc_order' function, called from the Cost Calculator Builder plugin. This makes it possible for unauthenticated attackers to manipulate the price of orders submitted via the calculator. Note: this vulnerability was partially patched with the release of Cost Calculator Builder version 3.2.17."}, {"lang": "es", "value": "El complemento Cost Calculator Builder PRO para WordPress es vulnerable a la manipulaci\u00f3n de precios en todas las versiones hasta la 3.1.96 incluida. Esto se debe a que el complemento permite manipular el campo de precio antes del procesamiento a trav\u00e9s de la funci\u00f3n 'create_cc_order', llamada desde el complemento Cost Calculator Builder. Esto hace posible que atacantes no autenticados manipulen el precio de los pedidos enviados a trav\u00e9s de la calculadora. Nota: esta vulnerabilidad fue parcialmente corregida con el lanzamiento de la versi\u00f3n 3.2.17 de Cost Calculator Builder."}], "id": "CVE-2024-6010", "lastModified": "2026-06-17T08:17:05.667", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-6010", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-09T13:51:48.473910Z", "version": "2.0.3"}}]}, "published": "2024-09-07T12:15:12.067", "references": [{"source": "security@wordfence.com", "url": "https://docs.stylemixthemes.com/cost-calculator-builder/changelog-1/changelog-pro-version"}, {"source": "security@wordfence.com", "tags": ["Issue Tracking"], "url": "https://plugins.trac.wordpress.org/browser/cost-calculator-builder/trunk/frontend/dist/order.js"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3172590/"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fc04e676-e394-488e-a239-95af5f865613?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-472"}], "source": "security@wordfence.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}