Stylemix Cost Calculator Builder Plugin up to 3.6.9 on WordPress Payment Status complete window.ccb_nonces authorization

Summaryinfo

A vulnerability classified as problematic has been found in Stylemix Cost Calculator Builder Plugin up to 3.6.9 on WordPress. The impacted element is the function Complete of the component Payment Status Handler. This manipulation of the argument window.ccb_nonces causes authorization. This vulnerability is tracked as CVE-2025-14757. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Stylemix Cost Calculator Builder Plugin up to 3.6.9 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function complete of the component Payment Status Handler. The manipulation of the argument window.ccb_nonces with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect integrity. The summary by CVE is:

The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Payment Status Bypass in all versions up to, and including, 3.6.9 only when used in combination with Cost Calculator Builder PRO. This is due to the complete_payment AJAX action being registered via wp_ajax_nopriv, making it accessible to unauthenticated users, and the complete() function only verifying a nonce without checking user capabilities or order ownership. Since nonces are exposed to all visitors via window.ccb_nonces in the page source, any unauthenticated attacker can mark any order's payment status as "completed" without actual payment.

The weakness was disclosed by Andrea Bocchetti. The advisory is shared at wordfence.com. This vulnerability is known as CVE-2025-14757 since 12/15/2025. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/16/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• WordPress Plugin

Vendor

• Stylemix

Name

• Cost Calculator Builder Plugin

Version

• 3.6.0
• 3.6.1
• 3.6.2
• 3.6.3
• 3.6.4
• 3.6.5
• 3.6.6
• 3.6.7
• 3.6.8
• 3.6.9

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion