The Cost Calculator Builder PRO plugin for WordPress versions up to 3.1.75 contains an improper input validation vulnerability (CWE-20) identified as CVE-2024-4787. This flaw exists in the 'send_pdf' and 'send_pdf_front' functions accessible via AJAX, which do not sufficiently restrict the email recipient or content parameters. As a result, unauthenticated attackers can send arbitrary emails to arbitrary recipients. The CVSS 3.1 base score is 5.8 (medium), reflecting network attack vector, no privileges required, no user interaction, scope changed, no confidentiality impact, limited integrity impact, and no availability impact. No known exploits in the wild or patches are currently documented.

The vulnerability allows unauthenticated attackers to send arbitrary emails with any content to any recipient via the vulnerable plugin's AJAX endpoints. This can lead to misuse such as spam or phishing emails being sent from the affected WordPress site. There is no direct impact on confidentiality or availability, but the integrity of email communications can be compromised. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or restricting access to the 'send_pdf' and 'send_pdf_front' AJAX functions if possible. Monitor for updates from StylemixThemes regarding a security patch. Avoid exposing the affected plugin on publicly accessible sites without additional protective controls.