What is the CVSS score of CVE-2026-10865?

CVE-2026-10865 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Cost Calculator Builder CVE-2026-10865

EUVD-2026-43152 MEDIUM

Information Exposure (CWE-200)

2026-07-11 Wordfence

GHSA-7cvm-m8m6-prmw

WordPress Information Disclosure Cost Calculator Builder Wordpress Plugin Stylemix

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

10.0 CRITICAL

Scope changes because secret keys control external payment gateway accounts; full API key disclosure yields high confidentiality and integrity impact against those accounts.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 11, 2026 - 07:07 vuln.today

CVE Published

Jul 11, 2026 - 05:35 cve.org

MEDIUM 5.3

DescriptionCVE.org

The Cost Calculator Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.11 via the (template body). This makes it possible for unauthenticated attackers to extract the plaintext Stripe secret key, Razorpay secret key, and PayPal client_secret embedded in the page source of any page containing a calculator, enabling full control of the merchant's payment gateway accounts. This exposure only occurs when the 'use in all calculators' option is enabled for one or more payment gateways in the plugin's global settings.

AnalysisAI

Plaintext payment gateway secret key exposure in the Cost Calculator Builder WordPress plugin (all versions ≤ 4.0.11) allows any unauthenticated remote visitor to harvest Stripe, Razorpay, and PayPal merchant credentials directly from page HTML source. The plugin embeds live API secret keys in the frontend template body when the 'use in all calculators' global payment gateway option is active, making those keys readable without any authentication or special tooling. While the assigned CVSS score is 5.3 (Medium), the practical impact is business-critical: extracted secret keys grant full programmatic control over the merchant's payment accounts, enabling unauthorized charges, refunds, and access to stored customer payment data. No public exploit or CISA KEV listing is identified at time of analysis.

Technical ContextAI

Cost Calculator Builder (vendor: StyleMix, CPE: cpe:2.3:a:stylemix:cost_calculator_builder:*:*:*:*:*:*:*:*) is a WordPress plugin that renders interactive pricing calculators on the frontend. The vulnerability is rooted in CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the plugin's frontend rendering pipeline - specifically templates/frontend/render.php (lines 28, 61, 281) and includes/functions.php (line 748) - writes payment gateway API credentials into the HTML template body that is delivered to every site visitor. This occurs when the plugin's global 'use in all calculators' toggle is enabled for any of the three supported gateways (Stripe, Razorpay, PayPal). The root cause is an architectural mistake: live secret API keys intended only for server-side use are passed through a Twig/PHP template context that renders into the public DOM, rather than being consumed exclusively in server-side PHP before the response is built. The disclosed credentials are not public-facing API keys but secret keys (Stripe secret key, Razorpay secret key, PayPal client_secret), which carry full account-management authority.

RemediationAI

Update the Cost Calculator Builder plugin to version 4.0.12 or later - a fix changeset has been committed to the WordPress plugin repository (see the Trac changeset reference: plugins.trac.wordpress.org/changeset?reponame=&old=3578557%40cost-calculator-builder&new=3578557%40cost-calculator-builder), though the exact released patched version number is inferred rather than explicitly confirmed in available data. Verify the update is available via the WordPress admin dashboard or the official plugin repository before deploying. As an immediate compensating control where updating is not immediately possible, disable the 'use in all calculators' option for all payment gateways in the plugin's global settings - this directly eliminates the condition that triggers the exposure, though it may interrupt calculator-based payment flows. Critically, any merchant who has run a vulnerable version with the global payment option enabled should treat their Stripe secret key, Razorpay secret key, and PayPal client_secret as compromised: rotate all affected credentials immediately via each payment provider's developer dashboard and audit transaction logs for unauthorized activity. Further advisory detail is available via Wordfence at https://www.wordfence.com/threat-intel/vulnerabilities/id/29de766d-5e7e-46b4-acac-feec5b33589e.