EUVD-2026-50268
GHSA-pm79-7c72-f572
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Nonce is publicly emitted via wp_head so it provides no real authentication, keeping PR:N; network-reachable, no interaction, and eval() gives full C/I/A impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.3 via the js_to_php function. This is due to insufficient sanitization of the orderDetails[*].originalValue field, which is injected verbatim into a calculator formula string passed to PHP eval() inside js_to_php(), with the regex allow-list in evaluateFormula() only filtering alphanumeric tokens and leaving non-word punctuation characters intact. This makes it possible for unauthenticated attackers to execute code on the server. The only authentication barrier is a nonce check, but the required nonce is publicly emitted on every front-end page via the wp_head hook, making it freely obtainable by unauthenticated visitors. Payloads must be non-word XOR gadgets to bypass sanitization.
AnalysisAI
Remote code execution in the StyleMixThemes Cost Calculator Builder PRO WordPress plugin (versions up to and including 4.0.3) lets unauthenticated attackers run arbitrary PHP on the server by injecting non-word XOR gadgets into the orderDetails[*].originalValue field, which is passed verbatim into a PHP eval() call inside js_to_php(). The only gate is a nonce, but that nonce is printed on every front-end page via wp_head, so any anonymous visitor can retrieve it, effectively removing the authentication barrier. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 9.8 rating and trivial nonce bypass make this a high-priority, pre-authentication server-takeover flaw.
Technical ContextAI
The affected component is a WordPress plugin (cpe:2.3:a:stylemixthemes:cost_calculator_builder_pro) that builds price calculators whose formulas are evaluated server-side. The root cause is CWE-94 (Improper Control of Generation of Code / Code Injection): the js_to_php() routine translates a client-supplied JavaScript-style formula into a PHP expression that is then handed to PHP's eval(). The evaluateFormula() guard uses a regex allow-list that only strips alphanumeric (word) tokens, so non-word punctuation characters pass through untouched. Because PHP allows expressions built entirely from punctuation (string XOR/increment 'gadgets'), an attacker can encode function names and calls using only symbols, defeating the alphanumeric filter and reaching eval() with attacker-controlled logic. The originalValue field inside orderDetails is the injection point.
RemediationAI
No vendor-released patch version is identified in the provided data (the record only states affected 'up to and including 4.0.3'), so treat any release newer than 4.0.3 as the target upgrade once StyleMixThemes publishes it and verify via the vendor page https://stylemixthemes.com/cost-calculator-plugin/ and the Wordfence advisory. Until a fixed version is confirmed and applied, the most effective compensating control is to deactivate and remove the Cost Calculator Builder PRO plugin, which eliminates the vulnerable calculator endpoint at the cost of removing calculator functionality from the site. If deactivation is not acceptable, restrict access to the plugin's AJAX/formula-processing endpoint (the handler invoking js_to_php) via a WAF rule that blocks orderDetails[*].originalValue payloads containing non-word/punctuation-only gadget patterns, and rate-limit or geo-fence front-end access; note that WAF signatures for symbol-only PHP gadgets are error-prone and may cause false positives or be bypassed. Monitor web and PHP error logs for anomalous eval activity as a detection fallback.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today