CVE-2025-14755: Cost Calculator Builder Auth Bypass Flaw

CVE-2025-14755 Overview

CVE-2025-14755 affects the Cost Calculator Builder plugin for WordPress when paired with Cost Calculator Builder PRO. The flaw allows unauthenticated price manipulation and Insecure Direct Object Reference (IDOR) in all versions up to and including 4.0.1. The ccb_woocommerce_payment AJAX action is registered via wp_ajax_nopriv, exposing it to unauthenticated users. The renderWooCommercePayment() function passes user-controlled data directly to CCBWooCheckout::init() without authorization checks. Attackers can add WooCommerce products to their cart with attacker-controlled prices, causing financial loss to store operators. The issue is tracked under CWE-862 Missing Authorization.

Critical Impact
Unauthenticated attackers can manipulate WooCommerce product prices on affected WordPress stores, enabling purchases at attacker-chosen values.

Affected Products

Cost Calculator Builder plugin for WordPress, versions up to and including 4.0.1
Cost Calculator Builder PRO (required for vulnerable code path to be reachable)
WordPress sites running WooCommerce with the above plugins installed

Discovery Timeline

2026-05-13 - CVE CVE-2025-14755 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2025-14755

Vulnerability Analysis

The vulnerability is a Missing Authorization flaw that combines two distinct weaknesses: an unauthenticated AJAX endpoint and an Insecure Direct Object Reference. The plugin registers the ccb_woocommerce_payment handler through wp_ajax_nopriv, which by design accepts requests from unauthenticated visitors. The handler then invokes renderWooCommercePayment(), which forwards request parameters directly into CCBWooCheckout::init(). No capability check, nonce verification, or server-side price validation occurs along this path. Attackers reference WooCommerce product IDs and submit arbitrary price values that the checkout flow accepts. The result is that a buyer can purchase products for any amount, including near-zero values. Because the attack relies on logic rather than memory corruption, it is reliable and reproducible across affected installations.

Root Cause

The root cause is the absence of server-side authorization and trust boundaries on the ccb_woocommerce_payment action. The plugin trusts client-supplied price data and skips re-validating values against the canonical product catalog stored in WooCommerce. Combined with the wp_ajax_nopriv registration, this creates a Missing Authorization condition mapped to CWE-862.

Attack Vector

The attack vector is network-based and requires no authentication, no user interaction, and no privileges. An attacker sends a crafted POST request to /wp-admin/admin-ajax.php specifying action=ccb_woocommerce_payment along with a target product ID and an attacker-chosen price. The vulnerable code path adds the product to the cart at the supplied price, and the attacker proceeds through checkout. See the Wordfence Vulnerability Report and the WordPress Plugin Source Code for the affected code paths in CCBAjaxAction.php and CCBOrderController.php.

Detection Methods for CVE-2025-14755

Indicators of Compromise

WooCommerce orders containing line items priced significantly below the catalog price for the same product SKU.
Access log entries showing POST requests to /wp-admin/admin-ajax.php with action=ccb_woocommerce_payment from unauthenticated sessions.
Repeated requests to the ccb_woocommerce_payment endpoint from a single IP address followed by completed checkouts.
Cart sessions created without a preceding product page view or add-to-cart event from the standard WooCommerce flow.

Detection Strategies

Compare each completed order line item price against the current WooCommerce product price and flag deviations beyond an allowed discount threshold.
Inspect web server access logs for the ccb_woocommerce_payment action string and correlate with order creation timestamps.
Enable WordPress audit logging to record AJAX action invocations and source IP addresses for the Cost Calculator Builder plugin.

Monitoring Recommendations

Forward WordPress, WooCommerce, and web server logs to a centralized SIEM and alert on price-mismatch events.
Monitor for traffic spikes to admin-ajax.php paired with the vulnerable action name.
Review payment gateway settlements daily for orders that closed at unusually low totals during the exposure window.

How to Mitigate CVE-2025-14755

Immediate Actions Required

Update the Cost Calculator Builder plugin to a version newer than 4.0.1 once the vendor publishes a fixed release.
If a patched version is not yet available, deactivate the Cost Calculator Builder and Cost Calculator Builder PRO plugins on production sites.
Audit recent WooCommerce orders for price manipulation and reverse or cancel fulfillment of affected transactions.

Patch Information

Review the vendor's plugin release notes on the WordPress plugin repository for an updated build that addresses CVE-2025-14755. The fix should add a capability or nonce check on the ccb_woocommerce_payment action and re-derive the product price server-side from the WooCommerce catalog rather than trusting client input. Refer to the Wordfence Vulnerability Report for the latest patch status.

Workarounds

Block requests to /wp-admin/admin-ajax.php containing action=ccb_woocommerce_payment at the web application firewall until a patched plugin version is installed.
Restrict the WooCommerce checkout to authenticated customers so abnormal cart sessions can be tied to user accounts.
Implement a server-side hook in WooCommerce (woocommerce_before_calculate_totals) that overrides cart item prices with values fetched from the product catalog.

bash

# Configuration example: WAF rule blocking the vulnerable AJAX action
# ModSecurity rule (adjust IDs and paranoia level for your deployment)
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1014755,\
    msg:'Block CVE-2025-14755 Cost Calculator Builder price manipulation'"
  SecRule ARGS:action "@streq ccb_woocommerce_payment" "t:none"