Unauthorized Data Access Vulnerability in Cost Calculator Builder Plugin for WordPress

CVE-2026-7753

What is CVE-2026-7753?

The Cost Calculator Builder plugin for WordPress presents a vulnerability allowing unauthorized access to sensitive data. This arises from a missing capability check on the cost-calculator-custom-export-run AJAX action. The action handler, CCBExportImport::export_calculators(), lacks sufficient authorization controls, relying solely on nonce verification, which is exposed on all wp-admin pages. As a consequence, authenticated users with Subscriber-level privileges can exploit this flaw to export full configurations of calculators, risking exposure of critical information such as Stripe and PayPal client secrets. This vulnerability necessitates immediate attention to prevent unauthorized data retrieval.

References