Skip to content
Threat Feed
Subscribe

Product

Cost Calculator Builder PRO Plugin (<= 4.0.3)

1 brief RSS
critical advisory

Remote Code Execution in Cost Calculator Builder PRO WordPress Plugin

The Cost Calculator Builder PRO plugin for WordPress, versions up to and including 4.0.3, is vulnerable to unauthenticated Remote Code Execution (RCE) via CVE-2026-14900 due to insufficient sanitization of the `orderDetails[*].originalValue` field, allowing arbitrary code injection into a `PHP eval()` call that can be exploited by unauthenticated attackers.

Cost Calculator Builder PRO plugin wordpress plugin rce web-exploitation cve
1r 2t 1c