CVE-2026-7753: CWE-862 Missing Authorization in stylemix Cost Calculator Builder
The Cost Calculator Builder plugin for WordPress has a missing authorization vulnerability in its AJAX export action, allowing authenticated users with Subscriber-level access or higher to export sensitive configuration data. This includes secret keys for Stripe, PayPal, Razorpay, webhook, and reCAPTCHA. The vulnerability affects all versions up to and including 3.6.17. The plugin only verifies a nonce that is publicly available to all authenticated users, failing to check user capabilities properly.
AI Analysis
Technical Summary
CVE-2026-7753 is a missing authorization vulnerability (CWE-862) in the Cost Calculator Builder WordPress plugin up to version 3.6.17. The AJAX action 'cost-calculator-custom-export-run' handled by CCBExportImport::export_calculators() verifies only a nonce for request validation. However, the nonce 'ccb_export_nonce' is exposed on all wp-admin pages, including those accessible by low-privilege roles such as Subscribers. This allows any authenticated user with Subscriber-level access or higher to export the full configuration of all calculators, exposing sensitive secrets such as Stripe secret keys, PayPal client secrets, Razorpay secret keys, webhook secret keys, and reCAPTCHA secret keys.
Potential Impact
An attacker with authenticated access at Subscriber level or above can export all calculator configurations, leading to disclosure of sensitive credentials and secret keys. This could compromise payment processing and other integrations relying on these secrets. The vulnerability does not allow privilege escalation or denial of service but results in high confidentiality impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to wp-admin pages to trusted users only and consider removing or disabling the Cost Calculator Builder plugin if sensitive data exposure risk is unacceptable.
CVE-2026-7753: CWE-862 Missing Authorization in stylemix Cost Calculator Builder
Description
The Cost Calculator Builder plugin for WordPress has a missing authorization vulnerability in its AJAX export action, allowing authenticated users with Subscriber-level access or higher to export sensitive configuration data. This includes secret keys for Stripe, PayPal, Razorpay, webhook, and reCAPTCHA. The vulnerability affects all versions up to and including 3.6.17. The plugin only verifies a nonce that is publicly available to all authenticated users, failing to check user capabilities properly.
CVSS v3.1
Score 6.5medium
Affected software
stylemix
Cost Calculator Builder
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-7753 is a missing authorization vulnerability (CWE-862) in the Cost Calculator Builder WordPress plugin up to version 3.6.17. The AJAX action 'cost-calculator-custom-export-run' handled by CCBExportImport::export_calculators() verifies only a nonce for request validation. However, the nonce 'ccb_export_nonce' is exposed on all wp-admin pages, including those accessible by low-privilege roles such as Subscribers. This allows any authenticated user with Subscriber-level access or higher to export the full configuration of all calculators, exposing sensitive secrets such as Stripe secret keys, PayPal client secrets, Razorpay secret keys, webhook secret keys, and reCAPTCHA secret keys.
Potential Impact
An attacker with authenticated access at Subscriber level or above can export all calculator configurations, leading to disclosure of sensitive credentials and secret keys. This could compromise payment processing and other integrations relying on these secrets. The vulnerability does not allow privilege escalation or denial of service but results in high confidentiality impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to wp-admin pages to trusted users only and consider removing or disabling the Cost Calculator Builder plugin if sensitive data exposure risk is unacceptable.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-05-03T19:15:00.975Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a72cd1fbf8831d5394f40f1
Added to database: 08/05/2026, 05:41:51 UTC
Last enriched: 08/12/2026, 15:52:53 UTC
Last updated: 09/18/2026, 22:01:38 UTC
Views: 51
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.