Unauthenticated Price Manipulation in Cost Calculator Builder by WordPress

CVE-2025-14755

What is CVE-2025-14755?

The Cost Calculator Builder plugin for WordPress is susceptible to vulnerabilities that enable unauthenticated users to manipulate pricing. Specifically, the ccb_woocommerce_payment AJAX action, which is registered via wp_ajax_nopriv, grants unauthenticated access to the function. This implementation flaw allows attackers to bypass authentication and submit unauthorized pricing information, enabling them to add WooCommerce products to their cart at dynamically controlled prices. The vulnerability is prevalent in all versions up to and including 4.0.1, particularly when used alongside Cost Calculator Builder PRO.

References