CVE-2025-9243 is a missing authorization vulnerability in the stylemix Cost Calculator Builder WordPress plugin. The issue arises from the lack of proper capability checks on the get_cc_orders and update_order_status functions, enabling authenticated users with low privileges (Subscriber and above) to access and modify order management functions. This vulnerability affects all versions up to and including 3.5.32. The CVSS v3.1 base score is 8.1, indicating a high severity with network attack vector, low attack complexity, and no user interaction required. Confidentiality and integrity impacts are high, while availability is not affected.

An attacker with at least Subscriber-level access can exploit this vulnerability to access order management functions and alter order statuses without proper authorization. This could lead to unauthorized data modification, potentially impacting order integrity and business processes relying on accurate order information. There is no indication of impact on system availability or known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles and permissions to trusted users only and monitor for suspicious activity related to order management functions. Avoid granting Subscriber-level or higher access to untrusted users. Follow updates from the plugin vendor for patch availability.