CVE-2026-7753 describes a missing authorization (CWE-862) vulnerability in the Cost Calculator Builder plugin for WordPress. The AJAX action 'cost-calculator-custom-export-run' handled by CCBExportImport::export_calculators() verifies only a nonce for request validation. However, the nonce 'ccb_export_nonce' is exposed on all wp-admin pages, including those accessible to low-privilege users such as Subscribers. This allows any authenticated user with Subscriber-level access or above to export the full configuration of all calculators, exposing sensitive secret keys for payment gateways and other integrations. The vulnerability affects all versions up to and including 3.6.17. No official patch or remediation guidance is currently available.

An attacker with authenticated Subscriber-level access can obtain sensitive configuration data including Stripe secret keys, PayPal client secrets, Razorpay secret keys, webhook secret keys, and reCAPTCHA secret keys. This exposure can lead to compromise of payment processing and other integrated services. The vulnerability does not impact availability or integrity but results in a high confidentiality impact. The CVSS 3.1 base score is 6.5 (medium severity) reflecting network attack vector, low complexity, low privileges required, no user interaction, and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict plugin usage to trusted users only and consider removing or disabling the Cost Calculator Builder plugin if possible. Monitor for updates from the vendor regarding an official fix or temporary mitigation.