CVE-2026-14900

Name of the Vulnerable Software and Affected Versions Cost Calculator Builder PRO versions prior to 4.0.4

Description Unauthenticated attackers can achieve remote code execution on the server via the js to php() function. The issue stems from insufficient sanitization of the orderDetails[*].originalValue field, which is injected into a calculator formula string and processed by the PHP eval() function. While the evaluateFormula() function uses a regex allow-list to filter alphanumeric tokens, it fails to filter non-word punctuation characters, allowing the use of non-word XOR gadgets to bypass security checks. Although a nonce check is present, the required nonce is publicly exposed on every front-end page through the wp head hook, rendering the authentication barrier ineffective.

Recommendations Update Cost Calculator Builder PRO to version 4.0.4 or later. As a temporary mitigation, restrict access to the js to php() function or the orderDetails[*].originalValue field until the update is applied.