CVE-2025-14757

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14757", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-15T22:56:12.691Z", "datePublished": "2026-01-16T08:38:29.508Z", "dateUpdated": "2026-04-08T17:17:46.406Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:17:46.406Z"}, "affected": [{"vendor": "stylemix", "product": "Cost Calculator Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.6.9", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Payment Status Bypass in all versions up to, and including, 3.6.9 only when used in combination with Cost Calculator Builder PRO. This is due to the complete_payment AJAX action being registered via wp_ajax_nopriv, making it accessible to unauthenticated users, and the complete() function only verifying a nonce without checking user capabilities or order ownership. Since nonces are exposed to all visitors via window.ccb_nonces in the page source, any unauthenticated attacker can mark any order's payment status as \"completed\" without actual payment."}], "title": "Cost Calculator Builder <= 3.6.9 - Missing Authorization to Unauthenticated Payment Status Bypass", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b8415e5f-17a4-425c-ac28-5dd886d1bcf1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/3.6.7/includes/classes/CCBOrderController.php#L408"}, {"url": "https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/3.6.7/includes/classes/CCBAjaxAction.php#L98"}, {"url": "https://plugins.trac.wordpress.org/changeset/3437516/cost-calculator-builder/trunk/includes/classes/CCBOrderController.php?old=3426823&old_path=cost-calculator-builder%2Ftrunk%2Fincludes%2Fclasses%2FCCBOrderController.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "andrea bocchetti"}], "timeline": [{"time": "2025-12-15T23:12:23.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-15T20:25:52.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-16T13:04:33.484410Z", "id": "CVE-2025-14757", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-16T13:04:53.115Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14757", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-16T13:04:33.484410Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-16T13:04:48.808Z"}}], "cna": {"title": "Cost Calculator Builder <= 3.6.9 - Missing Authorization to Unauthenticated Payment Status Bypass", "credits": [{"lang": "en", "type": "finder", "value": "andrea bocchetti"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "stylemix", "product": "Cost Calculator Builder", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.6.9"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-15T23:12:23.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-15T20:25:52.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b8415e5f-17a4-425c-ac28-5dd886d1bcf1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/3.6.7/includes/classes/CCBOrderController.php#L408"}, {"url": "https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/3.6.7/includes/classes/CCBAjaxAction.php#L98"}, {"url": "https://plugins.trac.wordpress.org/changeset/3437516/cost-calculator-builder/trunk/includes/classes/CCBOrderController.php?old=3426823&old_path=cost-calculator-builder%2Ftrunk%2Fincludes%2Fclasses%2FCCBOrderController.php"}], "descriptions": [{"lang": "en", "value": "The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Payment Status Bypass in all versions up to, and including, 3.6.9 only when used in combination with Cost Calculator Builder PRO. This is due to the complete_payment AJAX action being registered via wp_ajax_nopriv, making it accessible to unauthenticated users, and the complete() function only verifying a nonce without checking user capabilities or order ownership. Since nonces are exposed to all visitors via window.ccb_nonces in the page source, any unauthenticated attacker can mark any order's payment status as \"completed\" without actual payment."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:17:46.406Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14757", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:17:46.406Z", "dateReserved": "2025-12-15T22:56:12.691Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-16T08:38:29.508Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Cost Calculator Builder", "vendor": "stylemix", "versions": [{"lessThanOrEqual": "3.6.9", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:stylemixthemes:cost_calculator_builder:*:*:*:*:free:wordpress:*:*", "matchCriteriaId": "D74E8A9D-312F-4757-85E1-2F4B29ABA32D", "versionEndExcluding": "3.6.10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Payment Status Bypass in all versions up to, and including, 3.6.9 only when used in combination with Cost Calculator Builder PRO. This is due to the complete_payment AJAX action being registered via wp_ajax_nopriv, making it accessible to unauthenticated users, and the complete() function only verifying a nonce without checking user capabilities or order ownership. Since nonces are exposed to all visitors via window.ccb_nonces in the page source, any unauthenticated attacker can mark any order's payment status as \"completed\" without actual payment."}, {"lang": "es", "value": "El plugin Cost Calculator Builder para WordPress es vulnerable a la Omisi\u00f3n de Estado de Pago No Autenticado en todas las versiones hasta la 3.6.9, inclusive, solo cuando se usa en combinaci\u00f3n con Cost Calculator Builder PRO. Esto se debe a que la acci\u00f3n AJAX complete_payment se registra a trav\u00e9s de wp_ajax_nopriv, haci\u00e9ndola accesible a usuarios no autenticados, y la funci\u00f3n complete() solo verifica un nonce sin comprobar las capacidades del usuario o la propiedad del pedido. Dado que los nonces est\u00e1n expuestos a todos los visitantes a trav\u00e9s de window.ccb_nonces en el c\u00f3digo fuente de la p\u00e1gina, cualquier atacante no autenticado puede marcar el estado de pago de cualquier pedido como 'completado' sin un pago real."}], "id": "CVE-2025-14757", "lastModified": "2026-06-17T08:36:30.820", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14757", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-16T13:04:33.484410Z", "version": "2.0.3"}}]}, "published": "2026-01-16T09:15:59.663", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/3.6.7/includes/classes/CCBAjaxAction.php#L98"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/3.6.7/includes/classes/CCBOrderController.php#L408"}, {"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3437516/cost-calculator-builder/trunk/includes/classes/CCBOrderController.php?old=3426823&old_path=cost-calculator-builder%2Ftrunk%2Fincludes%2Fclasses%2FCCBOrderController.php"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b8415e5f-17a4-425c-ac28-5dd886d1bcf1?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T16:20:10.923293+00:00", "value": {"mitigation_remediation": ["Update the Cost Calculator Builder plugin to version 3.7 or newer, which removes the unauthenticated AJAX endpoint.", "If an immediate update is not possible, modify the plugin to restrict the complete_payment action to logged\u2011in users and verify that the caller has the necessary capabilities and owns the order before marking it as completed.", "Apply a web\u2011application firewall rule that blocks unauthenticated requests to the wp-admin/admin-ajax.php endpoint when the action is complete_payment.", "Monitor order logs for unexpected status changes and review financial records for irregular payments to detect potential abuse."], "summary": {"action": "Patch Now", "impact": "Unauthorized payment status modification leading to fraudulent order fulfillment"}, "threat_synthesis": {"affected_systems": "The vulnerability exists in both the free and PRO editions of the Cost Calculator Builder plugin released by Stylemix for WordPress. All versions up to and including 3.6.9 are affected when the PRO add\u2011on is present on a site.", "description_and_impact": "The Cost Calculator Builder plugin allows unauthenticated users to trigger a complete_payment AJAX action that is registered with wp_ajax_nopriv. The action validates only a publicly exposed nonce and does not verify that the caller has the required capabilities or that the order belongs to the caller. This access control weakness enables any visitor to set any order\u2019s status to \"completed\" without having performed a payment.", "risk_and_exploitability": "The CVSS score of 5.3 indicates a medium severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. An attacker can exploit the flaw simply by sending an unauthenticated HTTP request to the wp-admin/admin-ajax.php endpoint with action=complete_payment and a valid nonce, thereby marking orders as paid without authorization. The vulnerability does not enable arbitrary code execution but can result in financial loss and inventory mismanagement."}}}}, "created": "2026-01-16T13:41:36.788261+00:00", "updated": "2026-04-21T16:30:40.676338+00:00", "vendors": ["stylemixthemes", "stylemixthemes$PRODUCT$cost_calculator_builder", "wordpress", "wordpress$PRODUCT$wordpress"]}