Unauthenticated remote code execution in Cost Calculator Builder PRO (CVE-2026-14900)

The Cost Calculator Builder PRO plugin for WordPress contains insufficient sanitization of the `orderDetails[*].originalValue` field, which is injected verbatim into a calculator formula string passed to PHP `eval()` inside the `js_to_php()` function. The regex allow-list in `evaluateFormula()` filters only alphanumeric tokens, leaving non-word punctuation intact and permitting non-word XOR gadget payloads. A nonce intended as an authentication barrier is publicly emitted on every front-end page via the `wp_head` hook, making the vulnerability exploitable by unauthenticated attackers to execute arbitrary code on the server. Affected versions: - <= 4.0.3 We recommend updating to: 4.0.4. CVSS 9.8 · our assessment: act_now Reference: https://www.wordfence.com/threat-intel/vulnerabilities/id/4c8f2872-06ff-41a2-b601-77a47470de0c?source=cve Details: https://vuln.today/cve/CVE-2026-14900