What’s Vulnerable › Vulnerabilities

CVE-2024-6010: Cost Calculator Builder PRO <= 3.2.1 - Unauthenticated Price Manipulation

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-09-07 · updated 2026-06-17
• Weakness: CWE-472

Description

The Cost Calculator Builder PRO plugin for WordPress is vulnerable to price manipulation in all versions up to, and including, 3.2.1. This is due to the plugin allowing the price field to be manipulated prior to processing via the 'create_cc_order' function, called from the Cost Calculator Builder plugin. This makes it possible for unauthenticated attackers to manipulate the price of orders submitted via the calculator. Note: this vulnerability was partially patched with the release of Cost Calculator Builder version 3.2.17.

Affected products

• stylemix Cost Calculator Builder: through 3.1.96

References

• https://docs.stylemixthemes.com/cost-calculator-builder/changelog-1/changelog-pro-version
• https://plugins.trac.wordpress.org/browser/cost-calculator-builder/trunk/frontend/dist/order.js
• https://plugins.trac.wordpress.org/changeset/3172590/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/fc04e676-e394-488e-a239-95af5f865613?source=cve

Get alerted when CVE-2024-6010 or the next vulnerability affects your stack