CVE-2026-14900
The Cost Calculator Builder PRO plugin for WordPress is vulnerable to remote code execution. Attackers can inject code via the orderDetails[*].originalValue field, which is passed to PHP eval() without proper sanitization. The vulnerability allows unauthenticated attackers to run arbitrary code on the server.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
WordPress sites using the Cost Calculator Builder PRO plugin, versions up to and including 4.0.3.
Real-world impact
An attacker could run arbitrary code on the web server, potentially taking over the site, stealing data, or using the server for malicious purposes.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable over the network, requires no authentication, and gives attackers full control over the affected system.
What to do about it
- ›Disable or uninstall the Cost Calculator Builder PRO plugin until a patch is released.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources.