CVE-2026-14900: Cost Calculator Builder PRO RCE Flaw

CVE-2026-14900 Overview

CVE-2026-14900 is a critical remote code execution (RCE) vulnerability in the Cost Calculator Builder PRO plugin for WordPress. The flaw affects all versions up to and including 4.0.3. Unauthenticated attackers can execute arbitrary PHP code on the server by injecting crafted payloads into the orderDetails[*].originalValue field. The value flows into the js_to_php function and reaches a PHP eval() call inside a calculator formula string. A nonce check gates the endpoint, but the required nonce is emitted on every front-end page through the wp_head hook, making it trivially retrievable. The vulnerability is tracked under [CWE-94] (Improper Control of Generation of Code).

Critical Impact
Unauthenticated attackers can achieve full remote code execution on any WordPress site running Cost Calculator Builder PRO ≤ 4.0.3.

Affected Products

Cost Calculator Builder PRO plugin for WordPress, versions up to and including 4.0.3
WordPress sites publishing calculator forms via the plugin's front-end shortcodes
Stylemix Themes deployments bundling the vulnerable plugin

Discovery Timeline

2026-07-29 - CVE-2026-14900 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-14900

Vulnerability Analysis

The vulnerability resides in the plugin's server-side formula evaluation path. When a calculator submission is processed, the js_to_php function reconstructs the arithmetic formula string using values supplied by the client. The orderDetails[*].originalValue field is inserted verbatim into that formula and then passed to PHP's eval(). The regex allow-list inside evaluateFormula() only whitelists alphanumeric tokens, so non-word punctuation characters pass through unchanged. Attackers combine these punctuation characters with XOR gadgets to construct executable PHP without using any letters or digits directly.

Exploitation is unauthenticated. The endpoint enforces a WordPress nonce, but the plugin emits that nonce publicly through the wp_head action on every front-end page. An attacker fetches any page rendering the calculator, parses out the nonce, and submits the malicious payload against the plugin's AJAX action.

Root Cause

The root cause is unsafe use of eval() combined with an insufficient sanitization allow-list. The evaluateFormula() regex filter validates alphanumeric characters but does not restrict punctuation. Because PHP allows string construction via XOR of non-word characters, the allow-list is bypassable. Trusting client-supplied originalValue data inside a dynamically constructed expression violates safe evaluation practice and maps directly to [CWE-94].

Attack Vector

Exploitation follows three steps. First, the attacker requests any front-end page that renders the calculator and extracts the nonce injected by wp_head. Second, the attacker sends a POST request to the plugin's calculation AJAX handler with a crafted orderDetails[*].originalValue containing a non-word XOR gadget. Third, js_to_php concatenates the payload into a formula and eval() executes it in the WordPress PHP context. The attacker gains code execution with the privileges of the web server user. See the Wordfence Vulnerability Report for further technical detail.

Detection Methods for CVE-2026-14900

Indicators of Compromise

POST requests to admin-ajax.php targeting Cost Calculator Builder PRO actions containing dense non-word punctuation sequences in orderDetails parameters.
Unexpected PHP processes spawning shell utilities such as sh, bash, curl, or wget from the web server user context.
New or modified PHP files in wp-content/uploads/ or plugin directories following calculator form submissions.
Outbound network connections from the WordPress host to unfamiliar IPs immediately after calculator AJAX traffic.

Detection Strategies

Inspect web server and WAF logs for orderDetails payloads containing repeated XOR-style character sequences such as ^, ~, !, and quoted single characters.
Alert on eval() execution patterns in PHP error logs or opcache traces linked to the plugin's request handlers.
Correlate front-end page reads of pages containing calculator shortcodes with subsequent AJAX submissions from the same source IP within a short window.

Monitoring Recommendations

Enable PHP disable_functions audit logging to record any use of eval, system, exec, passthru, or proc_open.
Monitor file integrity across wp-content/plugins/cost-calculator-builder-pro/ and wp-content/uploads/ directories.
Track child process creation from PHP-FPM or Apache worker processes and alert on execution of interactive shells.

How to Mitigate CVE-2026-14900

Immediate Actions Required

Update Cost Calculator Builder PRO to a fixed release above version 4.0.3 as soon as the vendor publishes one.
Disable or remove the plugin on any site that cannot be patched immediately, especially publicly reachable installations.
Review web server and application logs for evidence of exploitation attempts against calculator AJAX endpoints since the plugin was installed.
Rotate WordPress secrets, administrator credentials, and any API keys stored in wp-config.php if exploitation is suspected.

Patch Information

At the time of publication, remediation guidance is available through the Wordfence Vulnerability Report and the vendor's Cost Calculator Builder plugin page. Administrators should install the vendor patch that removes use of eval() in js_to_php and enforces strict numeric validation on orderDetails values.

Workarounds

Deploy a Web Application Firewall (WAF) rule blocking POST requests whose orderDetails parameters contain non-alphanumeric character sequences beyond expected numeric formats.
Restrict access to the plugin's AJAX endpoints via IP allow-listing on staging or administrative environments.
Remove calculator shortcodes from public pages to prevent nonce disclosure through wp_head until a patched version is deployed.

bash

# Temporary mitigation: disable the plugin from WP-CLI
wp plugin deactivate cost-calculator-builder-pro