CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
What the vulnerability does
The Cost Calculator Builder PRO for WordPress is vulnerable to arbitrary email sending vulnerability in versions up to, and including, 3.1.75. This is due to insufficient limitations on the email recipient and the content in the 'send_pdf' and the 'send_pdf_front' functions which are reachable via AJAX. This makes it possible for unauthenticated attackers to send emails with any content to any recipient.
Explanation of Vulnerability in Simple Terms
Cost Calculator Builder PRO versions up to 3.1.75 contain an input validation flaw that allows unauthenticated attackers to modify data on the site. The vulnerability requires no user interaction and can be exploited over the network. Site administrators should update to a version newer than 3.1.75 to remediate the issue.
What an attacker can do
Modify or inject data on the site without authentication.
Potential impact on your site
Attackers can alter site content or data without logging in, potentially affecting site integrity and user trust.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
