Cost Calculator Builder CVE-2026-7753

Exploitation requires a valid WordPress account with at minimum Subscriber-level role on the target site - the lowest non-anonymous role, granted by default when a user registers if the site has open registration enabled (Settings → General → 'Anyone can register'). The attacker must be able to load any wp-admin page (including /wp-admin/profile.php, which is accessible to Subscribers) to receive the ccb_export_nonce value injected by the ccb_add_admin_nonces callback. Exploitation yields high-impact sensitive data only if the site operator has configured the plugin with at least one payment integration storing API secrets (Stripe, PayPal, Razorpay, webhooks, or reCAPTCHA); sites using Cost Calculator Builder solely for local price calculation without stored API credentials face low practical impact. There is no unauthenticated attack path - an active WordPress session is required. Limiting factors: sites with closed user registration and no untrusted existing Subscriber accounts are not exploitable by external attackers.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5 Medium) is technically accurate but understates business impact for sites with active payment integrations. The High confidentiality rating reflects the export of raw API secret keys; however, a stolen Stripe or PayPal secret key grants full programmatic access to the associated merchant account - enabling unauthorized charges, refund manipulation, and customer data enumeration - consequences that cascade well beyond the WordPress installation itself. No EPSS score was included in the intelligence feed. The vulnerability is not listed in CISA KEV at time of analysis, and no public exploit code has been identified. Despite these lower-severity signals, the attack complexity is genuinely minimal: the attacker needs only a Subscriber account, a single page load to harvest the nonce, and one AJAX POST. The critical limiting factor is the authentication requirement - sites without user registration enabled, or where all existing Subscriber accounts are trusted, face significantly lower realistic risk. Sites with open registration and active Stripe or PayPal integrations should treat this as a higher-priority finding than the CVSS score alone implies.

An attacker registers a free Subscriber account on the target WordPress site through the standard registration page, then logs into /wp-admin/profile.php - a page accessible to all authenticated users - and extracts the ccb_export_nonce value embedded in the page's inline JavaScript by the plugin's ccb_add_admin_nonces callback. The attacker then sends a single authenticated POST request to wp-admin/admin-ajax.php with the parameters action=cost-calculator-custom-export-run and the harvested nonce, receiving a full JSON export of all calculator configurations including plaintext Stripe secret keys, which they immediately use to issue unauthorized charges via the Stripe API against the merchant's account. No public proof-of-concept exploit code has been identified, but the technique is straightforward for any attacker familiar with WordPress AJAX mechanics.