CVE-2024-6010: Cost Calculator Builder PRO <= 3.2.1 - Unauthenticated Price Manipulation
First published: Sat Sep 07 2024(Updated: )
The Cost Calculator Builder PRO plugin for WordPress is vulnerable to price manipulation in all versions up to, and including, 3.2.1. This is due to the plugin allowing the price field to be manipulated prior to processing via the 'create_cc_order' function, called from the Cost Calculator Builder plugin. This makes it possible for unauthenticated attackers to manipulate the price of orders submitted via the calculator. Note: this vulnerability was partially patched with the release of Cost Calculator Builder version 3.2.17.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| StylemixThemes Cost Calculator Builder | <=3.1.96 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://plugins.trac.wordpress.org/browser/cost-calculator-builder/trunk/frontend/dist/order.js
- https://www.wordfence.com/threat-intel/vulnerabilities/id/fc04e676-e394-488e-a239-95af5f865613?source=cve
- https://docs.stylemixthemes.com/cost-calculator-builder/changelog-1/changelog-pro-version
- https://plugins.trac.wordpress.org/changeset/3172590/
Frequently Asked Questions
What is the severity of CVE-2024-6010?
The severity of CVE-2024-6010 is considered high due to the potential for price manipulation in WordPress installations using the Cost Calculator Builder PRO plugin.
How do I fix CVE-2024-6010?
To fix CVE-2024-6010, upgrade the Cost Calculator Builder PRO plugin to version 3.2.2 or later.
What versions are affected by CVE-2024-6010?
CVE-2024-6010 affects all versions of the Cost Calculator Builder PRO plugin up to and including version 3.2.1.
Who is affected by CVE-2024-6010?
Any user of the Cost Calculator Builder PRO plugin for WordPress who has not upgraded to the fixed version is vulnerable to this issue.
What functionality is compromised by CVE-2024-6010?
CVE-2024-6010 compromises the integrity of price calculations, allowing unauthorized alteration of prices prior to order processing.
- agent/weakness
- agent/first-publish-date
- agent/type
- agent/severity
- agent/author
- agent/event
- agent/softwarecombine
- agent/references
- agent/title
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/stylemixthemes
- canonical/stylemixthemes cost calculator builder
- version/stylemixthemes cost calculator builder/3.1.96