CVE-2026-54847: Stylish Cost Calculator Auth Bypass

CVE-2026-54847 Overview

CVE-2026-54847 is an unauthenticated broken access control vulnerability in the Stylish Cost Calculator WordPress plugin. All versions up to and including 8.3.9 are affected. The flaw is categorized under [CWE-862] Missing Authorization and allows remote attackers to reach protected functionality without providing credentials.

The vulnerability is exploitable over the network with low attack complexity and requires no user interaction. Successful exploitation exposes confidential data managed by the plugin. Patchstack published the advisory tracking the issue, and the CVE was added to the National Vulnerability Database on 2026-06-26.

Critical Impact
Unauthenticated attackers can access restricted plugin functionality on WordPress sites running Stylish Cost Calculator <= 8.3.9, leading to disclosure of confidential information.

Affected Products

Stylish Cost Calculator WordPress plugin versions <= 8.3.9
WordPress sites with the plugin installed and activated
All hosting environments serving the vulnerable plugin over the public internet

Discovery Timeline

2026-06-26 - CVE-2026-54847 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-54847

Vulnerability Analysis

The Stylish Cost Calculator plugin exposes one or more endpoints that fail to verify the caller's authorization before executing sensitive operations. Because the plugin does not enforce a capability check or nonce validation on the affected handlers, any unauthenticated visitor can invoke them directly. This is a textbook Missing Authorization flaw classified under [CWE-862].

The advisory reports impact limited to confidentiality, meaning the exposed function returns data the plugin was designed to restrict. Integrity and availability of the target site are not directly affected by this specific issue. The EPSS model places short-term exploitation probability in the lower range, but the low barrier to entry keeps opportunistic scanning likely.

Root Cause

The root cause is the absence of an authorization check on a plugin action handler. WordPress plugins typically gate privileged AJAX or REST endpoints with current_user_can(), check_ajax_referer(), or a permission_callback. In vulnerable versions of Stylish Cost Calculator, at least one such gate is missing, so the handler executes for anonymous requests.

Attack Vector

An attacker sends a crafted HTTP request to the vulnerable plugin endpoint on a target WordPress site. No authentication, session, or user interaction is required. The server responds with data or performs an action that should have been restricted to authorized users. Refer to the Patchstack Vulnerability Report for technical details on the specific endpoint.

Detection Methods for CVE-2026-54847

Indicators of Compromise

Unauthenticated HTTP POST or GET requests to admin-ajax.php or plugin REST routes containing stylish-cost-calculator or scc action parameters.
Repeated requests from a single source IP enumerating plugin endpoints without a valid wp_nonce.
Web server logs showing 200 OK responses to unauthenticated calls that return JSON payloads containing configuration or user-supplied calculator data.

Detection Strategies

Inventory WordPress installations and identify sites running Stylish Cost Calculator at version 8.3.9 or earlier.
Deploy web application firewall rules that require authenticated sessions for plugin action handlers.
Correlate access logs against known plugin endpoint paths to surface anomalous anonymous access patterns.

Monitoring Recommendations

Alert on spikes in traffic to /wp-admin/admin-ajax.php referencing the plugin's action names.
Monitor outbound responses for unexpected disclosure of plugin data structures.
Track plugin version drift across managed WordPress fleets to catch unpatched instances.

How to Mitigate CVE-2026-54847

Immediate Actions Required

Update Stylish Cost Calculator to a version later than 8.3.9 as soon as the vendor publishes a fixed release.
If a patched version is not yet available, disable and remove the plugin from production WordPress sites.
Review web server and application logs for prior unauthenticated access to plugin endpoints.

Patch Information

Consult the Patchstack Vulnerability Report for the current patched version and vendor guidance. Apply updates through the WordPress plugin management interface or via WP-CLI once the fix is released.

Workarounds

Restrict access to /wp-admin/admin-ajax.php and plugin REST routes at the WAF or reverse proxy layer until a patch is applied.
Deactivate the plugin on any site that does not actively use the cost calculator functionality.
Enforce IP allow-listing for administrative endpoints where feasible.

bash

# Configuration example: update the plugin via WP-CLI once a fixed release is available
wp plugin update stylish-cost-calculator --version=<patched-version>
wp plugin list --name=stylish-cost-calculator --fields=name,status,version