CVE-2026-7753 MEDIUM

CVE-2026-7753: Cost Calculator Builder <= 3.6.17 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure

Vendor Stylemix
Product Cost Calculator Builder
Weakness CWE-862 · Missing authorization
Published August 5, 2026
Last update August 5, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized access of sensitive data due to a missing capability check on the `cost-calculator-custom-export-run` AJAX action (handler `CCBExportImport::export_calculators()`) in all versions up to, and including, 3.6.17. The handler only verifies a nonce, but the corresponding `ccb_export_nonce` is broadcast on every wp-admin page (including pages reachable to Subscribers, such as `/wp-admin/profile.php`) by the `ccb_add_admin_nonces` callback hooked to `admin_head`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export every calculator's full configuration — including stored Stripe secret keys, PayPal client secrets, Razorpay secret keys, webhook secret keys, and reCAPTCHA secret keys.

Explanation of Vulnerability in Simple Terms

02Summary

Cost Calculator Builder through version 3.6.17 fails to properly check user permissions before allowing access to sensitive data. An authenticated user with low privileges can read information they should not have access to. The vulnerability requires a valid user account but no special interaction. Update to a version newer than 3.6.17.

What an attacker can do

03Attacker Capabilities

Read sensitive data they should not have access to as a low-privilege authenticated user.

Potential impact on your site

04Site Impact

Unauthorized disclosure of sensitive information to authenticated users with limited permissions.

Conditions required to exploit

05Prerequisites

Valid user account with low privileges; network access to the site.

Key dates

06Disclosure timeline

August 5, 2026 CVE published

Related vulnerabilities

08Related CVE

CVE-2026-12124 PDFDraft <= 1.1.0 - Missing Authorization to Unauthenticated Sensitive PDF Disclosure via 'slug' Parameter CVE-2026-65525 WordPress Civi Framework plugin <= 2.2.0 - Broken Access Control vulnerability CVE-2026-66712 WordPress Simple Membership plugin <= 4.7.8 - Broken Access Control vulnerability CVE-2026-7520 MailChimp Forms by MailMunch <= 3.2.7 - Missing Authorization to Authenticated (Subscriber+) MailMunch Integration Takeover via 'sign_in' AJAX Action CVE-2026-15411 StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Options Update via create_popup AJAX Action