CVE-2026-14900 is a critical remote code execution vulnerability in StylemixThemes' Cost Calculator Builder PRO WordPress plugin (up to version 4.0.3). The vulnerability is due to improper control of code generation (CWE-94) via the js_to_php function. Specifically, the orderDetails[*].originalValue field is insufficiently sanitized before being injected into a calculator formula string that is evaluated by PHP's eval() function. The regex allow-list in evaluateFormula() only filters alphanumeric tokens but leaves non-word punctuation characters intact, enabling attackers to craft payloads with non-word XOR gadgets to bypass sanitization. Although a nonce check is required, the nonce is publicly exposed on every front-end page, allowing unauthenticated attackers to obtain it and exploit the vulnerability remotely.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary PHP code on the server hosting the vulnerable WordPress plugin. This can lead to full system compromise, including data theft, service disruption, and further lateral movement within the environment. The CVSS 3.1 base score is 9.8 (critical), reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin or disable it if possible. Monitor vendor channels for updates. Avoid exposing the vulnerable plugin on public-facing sites without additional protective controls.