CVE-2026-10865 is a vulnerability in the stylemix Cost Calculator Builder WordPress plugin affecting all versions up to and including 4.0.11. When the global setting 'use in all calculators' is enabled for one or more payment gateways, the plugin exposes sensitive information such as Stripe secret keys, Razorpay secret keys, and PayPal client_secrets in the page source of any page containing a calculator. This exposure allows unauthenticated attackers to extract these credentials, leading to potential unauthorized control over the merchant's payment gateway accounts. The vulnerability is categorized under CWE-200 (Exposure of Sensitive Information). The CVSS v3.1 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to confidentiality.

The vulnerability allows unauthenticated attackers to retrieve plaintext secret keys for Stripe, Razorpay, and PayPal payment gateways from the page source of affected pages. This exposure can lead to unauthorized access and control over the merchant's payment gateway accounts, potentially enabling fraudulent transactions or data theft. There is no indication of impact to integrity or availability. The exposure only occurs if the 'use in all calculators' option is enabled in the plugin's global settings.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable the 'use in all calculators' option for payment gateways in the plugin's global settings to prevent exposure of secret keys. Monitor vendor communications for updates and apply any official patches once released.