CVE-2025-14757: Cost Calculator Builder <= 3.6.9 - Missing Authorization to Unauthenticated Payment Status Bypass
The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Payment Status Bypass in all versions up to, and including, 3.6.9 only when used in combination with Cost Calculator Builder PRO. This is due to the completepayment AJAX action being registered via wpajaxnopriv, making it accessible to unauthenticated users, and the complete() function only verifying a nonce without checking user capabilities or order ownership. Since nonces are exposed to all visitors via window.ccbnonces in the page source, any unauthenticated attacker can mark any order's payment status as "completed" without actual payment.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14757?
CVE-2025-14757 is considered a medium severity vulnerability due to its potential for unauthorized access to payment statuses.
What versions of Cost Calculator Builder are affected by CVE-2025-14757?
CVE-2025-14757 affects all versions of Cost Calculator Builder up to and including 3.6.9.
How do I fix CVE-2025-14757?
To fix CVE-2025-14757, update the Cost Calculator Builder plugin to the latest version available.
What kind of impact does CVE-2025-14757 have on my website?
CVE-2025-14757 allows unauthenticated users to bypass payment status checks, potentially leading to financial fraud.
Is authentication required to exploit CVE-2025-14757?
No, CVE-2025-14757 can be exploited without authentication, making it particularly dangerous.