CVE-2026-7753: Cost Calculator Builder <= 3.6.17 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure
The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized access of sensitive data due to a missing capability check on the cost-calculator-custom-export-run AJAX action (handler CCBExportImport::exportcalculators()) in all versions up to, and including, 3.6.17. The handler only verifies a nonce, but the corresponding ccbexportnonce is broadcast on every wp-admin page (including pages reachable to Subscribers, such as /wp-admin/profile.php) by the ccbaddadminnonces callback hooked to adminhead. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export every calculator's full configuration — including stored Stripe secret keys, PayPal client secrets, Razorpay secret keys, webhook secret keys, and reCAPTCHA secret keys.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Cost Calculator Builder pluginto a version that resolves this vulnerability.Fixed in 3.6.17 - Configuration
Update the `cost-calculator-custom-export-run` AJAX handler `CCBExportImport::export_calculators()` to perform a capability/capability check and block non-privileged users (Subscriber and below), in addition to the existing nonce verification.
WordPress Cost Calculator Builder plugin capability check for AJAX action cost-calculator-custom-export-run (handler CCBExportImport::export_calculators()) = Require an appropriate capability (deny for Subscriber) - Configuration
Modify `ccb_add_admin_nonces` so the `ccb_export_nonce` is not broadcast on every wp-admin page (including pages reachable to Subscribers such as `/wp-admin/profile.php`); only render it for users permitted to access `cost-calculator-custom-export-run`.
WordPress Cost Calculator Builder plugin ccb_export_nonce exposure via admin_head (callback ccb_add_admin_nonces) = Only output/export nonce to users who are allowed to run the export action - Operational
If any exports occurred, rotate any exposed secrets that may have been disclosed via calculator configuration (Stripe secret keys, PayPal client secrets, Razorpay secret keys, webhook secret keys, and reCAPTCHA secret keys) after applying the fix.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7753?
The severity of CVE-2026-7753 is medium with a score of 6.5.
What kind of vulnerability is CVE-2026-7753?
CVE-2026-7753 is a missing authorization vulnerability that leads to the disclosure of sensitive information.
Which versions of the Cost Calculator Builder are affected by CVE-2026-7753?
CVE-2026-7753 affects all versions of the Cost Calculator Builder plugin for WordPress up to and including 3.6.17.
How do I fix CVE-2026-7753?
To fix CVE-2026-7753, update the Cost Calculator Builder plugin to the latest version that includes the necessary authorization checks.
What data is exposed due to CVE-2026-7753?
CVE-2026-7753 allows unauthorized access to authenticated subscriber-sensitive data through the AJAX action handler.