CVE-2024-6010: The Cost Calculator Builder PRO plugin for WordPress is vulnerable to price manipulation in all versions up to, and including, 3.2.1. This is due to the plugin…

PriorityP429medium5.3CVSS 3.1

AVNACLPRNUINSUCNILAN

EPSS

0.42%

33.5th percentile

The Cost Calculator Builder PRO plugin for WordPress is vulnerable to price manipulation in all versions up to, and including, 3.2.1. This is due to the plugin allowing the price field to be manipulated prior to processing via the 'create_cc_order' function, called from the Cost Calculator Builder plugin. This makes it possible for unauthenticated attackers to manipulate the price of orders submitted via the calculator. Note: this vulnerability was partially patched with the release of Cost Calculator Builder version 3.2.17.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
stylemixthemes	cost_calculator_builder	<= 3.1.96	—
stylemixthemes	cost_calculator_builder_pro	<= 3.2.1	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.