CVE-2026-14900 is a critical remote code execution vulnerability in StylemixThemes' Cost Calculator Builder PRO WordPress plugin, affecting all versions up to and including 4.0.3. The vulnerability arises from insufficient sanitization of the orderDetails[*].originalValue field, which is injected directly into a calculator formula string evaluated by PHP's eval() function inside the js_to_php() method. The regex allow-list in evaluateFormula() only filters alphanumeric tokens, leaving non-word punctuation characters intact, enabling code injection. Although a nonce check is required, the nonce is publicly emitted on every front-end page via the wp_head hook, making it accessible to unauthenticated attackers. Exploitation requires crafting payloads with non-word XOR gadgets to bypass sanitization.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary PHP code on the server hosting the vulnerable plugin, leading to full compromise of the affected WordPress site. This includes complete confidentiality, integrity, and availability loss as indicated by the CVSS vector (C:H/I:H/A:H).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable or remove the Cost Calculator Builder PRO plugin if possible. Monitor the vendor's channels for updates and apply patches promptly once available.