CVE-2026-14900: Unauthenticated RCE in Cost Calculator Builder PRO <= 4.0.3

Vulnerability Overview Vulnerability Name: Cost Calculator Builder PRO <= 4.0.3 - Unauthenticated Remote Code Execution via 'orderDetails' Parameter CVE ID: CVE-2026-14900 CVSS Score: 9.8 (Critical) Publication Date: July 28, 2026 Last Update Date: July 29, 2026 Researcher: Nox Axter Affected Scope Software Type: Plugin Software Slug: cost-calculator-builder-pro Affected Versions: <= 4.0.3 Fixed Version: 4.0.4 Remediation Fix Method: Upgrade to version 4.0.4 or higher Vulnerability Description The Cost Calculator Builder PRO plugin contains a remote code execution vulnerability that allows attackers to execute arbitrary code via unauthenticated requests. The root cause is the insufficient sanitization of the raw value when injected into calculator formula strings, enabling code execution. The sole authentication barrier is a nonce check; however, the required nonce is publicly issued on every frontend page, allowing unauthenticated visitors to easily obtain it. The payload must utilize a non-word XOR gadget to bypass sanitization. References stylemixthemes.com Additional Information Recently Discovered Vulnerabilities: - CVE-2024-11939: Unauthenticated SQL Injection via data (CVSS: 7.5) - CVE-2024-6610: Unauthenticated Price Manipulation (CVSS: 5.3) - CVE-2024-4787: Unauthenticated Arbitrary Email Sending (CVSS: 5.8) - CVE-2024-4789: Authenticated (Subscriber+) Server-Side Request Forgery (CVSS: 6.4) - CVE-2024-4097: Unauthenticated Cross-Site Scripting via SVG Upload (CVSS: 7.2) Disclaimer This record contains copyrighted material, owned by Defiant Inc. and The MITRE Corporation. Contact For any questions or further information, please contact: wfi-support@wordfence.com Business Hours Eastern Time 9am-8pm, Pacific Time 6am-5pm, UTC/GMT 2pm-1am (excluding weekends and holidays) Customer Support: 24 hours a day, 365 days a year, with a 1-hour response time Other Links Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Social Media Facebook Twitter LinkedIn Instagram Subscription Subscribe to receive the latest security news and updates Copyright © 2012-2026 Defiant Inc. All Rights Reserved Other Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Support Documentation Learning Center Free Support Premium Support News Blog In The News Vulnerability Advisories About About Wordfence Affiliate Program Employment Contact Security CVE Request Form Subscription Subscribe to receive the latest security news and updates Copyright © 2012-2026 Defiant Inc. All Rights Reserved Other Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Support Documentation Learning Center Free Support Premium Support News Blog In The News Vulnerability Advisories About About Wordfence Affiliate Program Employment Contact Security CVE Request Form Subscription Subscribe to receive the latest security news and updates Copyright © 2012-2026 Defiant Inc. All Rights Reserved Other Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Support Documentation Learning Center Free Support Premium Support News Blog In The News Vulnerability Advisories About About Wordfence Affiliate Program Employment Contact Security CVE Request Form Subscription Subscribe to receive the latest security news and updates Copyright © 2012-2026 Defiant Inc. All Rights Reserved Other Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Support Documentation Learning Center Free Support Premium Support News Blog In The News Vulnerability Advisories About About Wordfence Affiliate Program Employment Contact Security CVE Request Form Subscription Subscribe to receive the latest security news and updates Copyright © 2012-2026 Defiant Inc. All Rights Reserved Other Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Support Documentation Learning Center Free Support Premium Support News Blog In The News Vulnerability Advisories About About Wordfence Affiliate Program Employment Contact Security CVE Request Form Subscription Subscribe to receive the latest security news and updates Copyright © 2012-2026 Defiant Inc. All Rights Reserved Other Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Support Documentation Learning Center Free Support Premium Support News Blog In The News Vulnerability Advisories About About Wordfence Affiliate Program Employment Contact Security CVE Request Form Subscription Subscribe to receive the latest security news and updates Copyright © 2012-2026 Defiant Inc. All Rights Reserved Other Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intellig

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-14900: Unauthenticated RCE in Cost Calculator Builder PRO <= 4.0.3