Remote Code Execution Vulnerability in Cost Calculator Builder PRO Plugin for WordPress

CVE-2026-14900

What is CVE-2026-14900?

The Cost Calculator Builder PRO plugin for WordPress is susceptible to Remote Code Execution due to inadequate sanitization of the orderDetails[*].originalValue input field. This vulnerability affects all versions up to 4.0.3. An unauthenticated attacker can exploit this flaw by injecting malicious code into a calculator formula. The injected code is passed to the PHP eval() function without proper filtering, which allows the attacker to execute arbitrary code on the server. The only form of protection is a nonce check, which is rendered ineffective as the nonce is publicly accessible on all front-end pages. Attackers can bypass the minimal sanitization checks using non-word XOR gadgets.

References