CVE-2026-10865: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in stylemix Cost Calculator Builder
The Cost Calculator Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.11 via the (template body). This makes it possible for unauthenticated attackers to extract the plaintext Stripe secret key, Razorpay secret key, and PayPal client_secret embedded in the page source of any page containing a calculator, enabling full control of the merchant's payment gateway accounts. This exposure only occurs when the 'use in all calculators' option is enabled for one or more payment gateways in the plugin's global settings.
AI Analysis
Technical Summary
CVE-2026-10865 describes a sensitive information exposure vulnerability in the Cost Calculator Builder WordPress plugin (stylemix). In all versions up to and including 4.0.11, if the 'use in all calculators' option is enabled for payment gateways, the plugin embeds plaintext secret keys for Stripe, Razorpay, and PayPal in the page source of any page containing a calculator. This exposure allows unauthenticated attackers to extract these secrets and gain control over the merchant's payment gateway accounts. The CVSS 3.1 base score is 5.3 (medium severity), reflecting the network attack vector, no privileges required, and no user interaction needed. No official patch or remediation guidance is currently documented.
Potential Impact
The vulnerability allows unauthorized disclosure of sensitive payment gateway credentials (Stripe secret key, Razorpay secret key, PayPal client_secret) to unauthenticated attackers. This can lead to full control over the merchant's payment gateway accounts, potentially enabling fraudulent transactions or financial loss. The impact is limited to confidentiality; integrity and availability are not directly affected.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable the 'use in all calculators' option for payment gateways in the plugin's global settings to prevent exposure of secret keys. Review and rotate any exposed payment gateway credentials to mitigate potential compromise.
CVE-2026-10865: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in stylemix Cost Calculator Builder
Description
The Cost Calculator Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.11 via the (template body). This makes it possible for unauthenticated attackers to extract the plaintext Stripe secret key, Razorpay secret key, and PayPal client_secret embedded in the page source of any page containing a calculator, enabling full control of the merchant's payment gateway accounts. This exposure only occurs when the 'use in all calculators' option is enabled for one or more payment gateways in the plugin's global settings.
CVSS v3.1
Score 5.3medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-10865 describes a sensitive information exposure vulnerability in the Cost Calculator Builder WordPress plugin (stylemix). In all versions up to and including 4.0.11, if the 'use in all calculators' option is enabled for payment gateways, the plugin embeds plaintext secret keys for Stripe, Razorpay, and PayPal in the page source of any page containing a calculator. This exposure allows unauthenticated attackers to extract these secrets and gain control over the merchant's payment gateway accounts. The CVSS 3.1 base score is 5.3 (medium severity), reflecting the network attack vector, no privileges required, and no user interaction needed. No official patch or remediation guidance is currently documented.
Potential Impact
The vulnerability allows unauthorized disclosure of sensitive payment gateway credentials (Stripe secret key, Razorpay secret key, PayPal client_secret) to unauthenticated attackers. This can lead to full control over the merchant's payment gateway accounts, potentially enabling fraudulent transactions or financial loss. The impact is limited to confidentiality; integrity and availability are not directly affected.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable the 'use in all calculators' option for payment gateways in the plugin's global settings to prevent exposure of secret keys. Review and rotate any exposed payment gateway credentials to mitigate potential compromise.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-06-04T14:10:06.318Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a51e39f68715ace434f569c
Added to database: 07/11/2026, 06:33:03 UTC
Last enriched: 07/11/2026, 06:48:50 UTC
Last updated: 07/12/2026, 04:09:14 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.