CVE-2026-10865: Cost Calculator Builder Information Disclosure

CVE-2026-10865 Overview

The Cost Calculator Builder plugin for WordPress contains a sensitive information exposure flaw affecting all versions up to and including 4.0.11. The vulnerability exposes plaintext payment gateway secrets in the rendered page source of any page that embeds a calculator. Unauthenticated attackers can extract the Stripe secret key, Razorpay secret key, and PayPal client_secret directly from HTML output. This exposure only occurs when the use in all calculators option is enabled for one or more payment gateways in the plugin's global settings. Successful exploitation grants full control of the merchant's payment gateway accounts, enabling fraudulent charges, refund abuse, and account takeover.

Critical Impact
Unauthenticated remote attackers can retrieve plaintext Stripe, Razorpay, and PayPal API secrets from public page source, leading to complete takeover of the merchant's payment gateway accounts.

Affected Products

Cost Calculator Builder plugin for WordPress — all versions up to and including 4.0.11
WordPress sites that enable the use in all calculators option for any supported payment gateway
Merchant payment gateway integrations for Stripe, Razorpay, and PayPal configured through the plugin

Discovery Timeline

2026-07-11 - CVE-2026-10865 published to the National Vulnerability Database (NVD)
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-10865

Vulnerability Analysis

The issue is categorized under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor]. The Cost Calculator Builder plugin renders calculator templates into the frontend page body without separating server-side payment credentials from client-visible configuration. When an administrator enables the use in all calculators option, the plugin propagates the configured gateway credentials into every calculator instance. The rendering pipeline in templates/frontend/render.php then serializes those credentials into the HTML delivered to any visitor. Because the calculator is designed to be embedded on public pages, the disclosure is reachable over the network without authentication or user interaction.

Root Cause

The root cause is improper separation between backend secrets and frontend template data. Payment gateway secret keys — which must remain server-side — are stored alongside publishable configuration and passed to the template renderer. The functions.php handler responsible for loading payment settings returns the full credential set to the frontend context, and the render template outputs those values inside the DOM. No sanitization or key-scope filtering removes secret material before output.

Attack Vector

An unauthenticated attacker locates any public WordPress page containing a Cost Calculator Builder instance. The attacker requests the page over HTTP or HTTPS and parses the returned HTML or embedded JavaScript configuration blob. The Stripe secret_key, Razorpay key_secret, and PayPal client_secret values appear in plaintext within the page source. The attacker then uses these credentials to authenticate directly to the payment provider APIs. From that point, the attacker can issue refunds, create charges, retrieve customer payment data, or rotate webhook endpoints under the merchant identity.

No exploitation code is required beyond a standard HTTP client and HTML parsing. See the Wordfence Vulnerability Report and the affected code paths in render.php line 28, render.php line 61, and render.php line 281 for the exact disclosure points.

Detection Methods for CVE-2026-10865

Indicators of Compromise

Presence of strings matching sk_live_, sk_test_, rzp_live_, or client_secret in the rendered HTML of pages containing the [cost_calculator] shortcode.
Outbound API activity to api.stripe.com, api.razorpay.com, or api.paypal.com originating from IP addresses that do not match the merchant's known infrastructure.
Unexpected refunds, payouts, or webhook endpoint modifications recorded in the payment provider's audit log.

Detection Strategies

Fetch every published page and post that embeds the Cost Calculator Builder shortcode and grep the response body for gateway secret prefixes.
Enable payment provider audit logging and alert on API calls made from IPs outside the merchant's allow-list.
Review the WordPress plugin inventory for cost-calculator-builder at version 4.0.11 or earlier and confirm whether use in all calculators is enabled in global settings.

Monitoring Recommendations

Monitor Stripe, Razorpay, and PayPal dashboards for new API keys, webhook changes, or refunds outside normal business patterns.
Ingest web server access logs into a SIEM and flag high-volume anonymous crawling of pages that host the calculator.
Track WordPress plugin version changes through file integrity monitoring to confirm patch application.

How to Mitigate CVE-2026-10865

Immediate Actions Required

Rotate all Stripe, Razorpay, and PayPal secret keys through the respective payment provider consoles before applying any other fix.
Disable the use in all calculators option for every payment gateway in the plugin's global settings until the plugin is updated.
Update the Cost Calculator Builder plugin to a version later than 4.0.11 once the vendor's patched release is available.
Review recent transactions, refunds, and webhook configurations in each payment provider for unauthorized activity.

Patch Information

The vendor addressed the disclosure in a plugin update tracked in the WordPress Changeset Overview. Site operators should upgrade to the latest release of Cost Calculator Builder and confirm the version reported in the WordPress plugin manager is greater than 4.0.11. Additional technical context is available in the Wordfence Vulnerability Report.

Workarounds

Turn off the use in all calculators toggle for Stripe, Razorpay, and PayPal in the plugin's global settings to stop credential propagation to the frontend.
Temporarily unpublish or restrict access to pages that embed the calculator until the plugin is updated.
Restrict payment provider API keys to IP allow-lists at the gateway level so that leaked credentials cannot be used from arbitrary hosts.
Replace the affected plugin with a payment integration that keeps secret keys server-side only.

bash

# Configuration example: verify plugin version and search for exposed secrets
wp plugin get cost-calculator-builder --field=version
curl -s https://example.com/pricing/ | grep -Eo 'sk_(live|test)_[A-Za-z0-9]+|rzp_(live|test)_[A-Za-z0-9]+|"client_secret":"[^"]+"'