CVE-2026-7753

Name of the Vulnerable Software and Affected Versions Cost Calculator Builder versions prior to 3.6.18

Description An issue allows authenticated users with Subscriber-level access and above to gain unauthorized access to sensitive data. The cost-calculator-custom-export-run AJAX action, handled by the CCBExportImport::export calculators() function, fails to perform a capability check. While the handler verifies a nonce, the ccb export nonce variable is broadcast on every wp-admin page, including those accessible to Subscribers like /wp-admin/profile.php, via the ccb add admin nonces callback. This allows attackers to export the full configuration of all calculators, which may include Stripe secret keys, PayPal client secrets, Razorpay secret keys, webhook secret keys, and reCAPTCHA secret keys.

Recommendations Update to a version newer than 3.6.17.