Cost Calculator Builder CVE-2025-14755

The vulnerability requires Cost Calculator Builder PRO to be active in addition to the free Cost Calculator Builder plugin; the free plugin version alone does not expose this flaw. The vulnerable AJAX action ccb_woocommerce_payment must be callable from unauthenticated requests, which occurs by default due to wp_ajax_nopriv registration. The WooCommerce integration must be enabled and the checkout flow must invoke the vulnerable renderWooCommercePayment() function, which happens automatically when a user attempts to proceed through the cost calculator checkout. No special server configuration, non-default settings, or user interaction (such as clicking a malicious link) is required - an attacker can directly POST to the AJAX endpoint and manipulate prices. The attack is not limited by IP, geography, or rate limiting. No authentication bypass technique or privilege escalation is necessary; the action is explicitly registered for unauthenticated access.

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U) indicates a remotely exploitable vulnerability requiring no interaction or privileges, which typically elevates risk. However, the integrity-only impact (I:L with C:N/A:N) reflects that attackers can modify prices but cannot exfiltrate data or disrupt service. The attack complexity is low and no user interaction is needed, making exploitation trivial. Real-world risk is substantial for e-commerce sites using this plugin with WooCommerce, as attackers can systematically purchase products at artificially reduced prices, resulting in direct financial loss. The lack of authentication combined with direct price manipulation creates a business logic attack vector that bypasses normal checkout controls. EPSS exploitation probability is not provided, but the public nature of the vulnerability (disclosed via Wordfence threat intelligence) and straightforward exploitation mechanics (simple AJAX POST with price parameters) suggest high practical exploitability. No ambiguity exists in the technical details: authentication is definitively absent, authorization checks are missing, and the attack is unauthenticated network-based.

An attacker identifies a WordPress site running Cost Calculator Builder with PRO enabled by observing AJAX requests to ccb_woocommerce_payment in browser developer tools. The attacker crafts a POST request to /wp-admin/admin-ajax.php?action=ccb_woocommerce_payment with manipulated price parameters (e.g., setting a $500 product price to $1) and submits it without authentication. The server processes the malicious data and adds the product to the cart at the attacker-controlled price, allowing purchase completion at a fraction of the legitimate cost.