Unauthenticated Payment Status Bypass in Cost Calculator Builder Plugin for WordPress

CVE-2025-14757

What is CVE-2025-14757?

The Cost Calculator Builder plugin for WordPress contains a vulnerability that allows unauthenticated users to modify payment statuses of orders. This flaw arises from the complete_payment AJAX action being accessible to unauthenticated users due to its registration via wp_ajax_nopriv. The vulnerability exists in versions up to and including 3.6.9, particularly when used alongside Cost Calculator Builder PRO. The complete() function erroneously verifies only a nonce, failing to check user capabilities or order ownership. This exposes a significant risk, as any attacker can manipulate order payment statuses to 'completed', undermining payment integrity through a public nonce available in the page source.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References