CVE-2026-7753: Cost Calculator Builder Auth Bypass Flaw

CVE-2026-7753 Overview

CVE-2026-7753 is a missing authorization vulnerability [CWE-862] in the Cost Calculator Builder plugin for WordPress, affecting all versions up to and including 3.6.17. The cost-calculator-custom-export-run AJAX action, handled by CCBExportImport::export_calculators(), verifies only a nonce and omits any capability check. The ccb_export_nonce is emitted on every wp-admin page through the ccb_add_admin_nonces callback hooked to admin_head, including pages reachable by Subscriber-level users such as /wp-admin/profile.php. Authenticated attackers with Subscriber access or higher can export every calculator's full configuration, exposing stored payment provider secrets.

Critical Impact
Subscriber-level users can exfiltrate Stripe secret keys, PayPal client secrets, Razorpay secret keys, webhook secrets, and reCAPTCHA secret keys from any affected WordPress site.

Affected Products

Cost Calculator Builder plugin for WordPress, all versions through 3.6.17
WordPress sites permitting Subscriber-level (or higher) account registration
Sites using the plugin's integrated Stripe, PayPal, Razorpay, or reCAPTCHA configurations

Discovery Timeline

2026-08-05 - CVE-2026-7753 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-7753

Vulnerability Analysis

The vulnerability resides in the CCBExportImport::export_calculators() handler registered for the cost-calculator-custom-export-run AJAX action. The handler validates a nonce but never calls current_user_can() or any equivalent capability check. Because WordPress nonces are designed as CSRF tokens rather than authorization primitives, nonce verification alone does not restrict which roles may invoke the action.

The ccb_add_admin_nonces callback hooks into admin_head and prints ccb_export_nonce on every admin page. Subscribers retain access to /wp-admin/profile.php, so any authenticated user can read the nonce value directly from the rendered HTML. The exported payload includes complete calculator configurations, embedding cleartext credentials for payment processors and third-party services.

Root Cause

The root cause is a broken access control failure classified under CWE-862 (Missing Authorization). The plugin conflates request authenticity (nonce validation) with authorization (capability enforcement). Sensitive data export must gate on an administrative capability such as manage_options, which the handler does not perform.

Attack Vector

An attacker registers or obtains a Subscriber account on the target WordPress site. The attacker loads any admin page available to Subscribers, scrapes the ccb_export_nonce value from the DOM, and issues a POST request to admin-ajax.php with action=cost-calculator-custom-export-run and the harvested nonce. The server returns the full calculator export containing Stripe, PayPal, Razorpay, webhook, and reCAPTCHA secret keys. No user interaction from an administrator is required.

A public proof-of-concept has not been confirmed at the time of publication. Technical detail for the affected handler is documented in the WordPress Plugin File Export source and the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2026-7753

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php with the parameter action=cost-calculator-custom-export-run originating from non-administrator sessions
Unexpected JSON export responses containing keys such as stripe_secret_key, paypal_client_secret, or razorpay_key_secret
Newly registered Subscriber accounts issuing admin-ajax requests shortly after login
Outbound authentications or transactions using payment provider credentials from unexpected IP ranges

Detection Strategies

Inspect web server access logs for cost-calculator-custom-export-run invocations correlated against the requesting user's WordPress role
Alert on any admin-ajax.php request where the response body exceeds a baseline size for calculator export endpoints
Compare current payment provider API key fingerprints against known-good values to identify credentials that may have been exposed

Monitoring Recommendations

Enable WordPress audit logging to record AJAX action invocations along with the authenticated user ID and role
Monitor Stripe, PayPal, and Razorpay dashboards for unauthorized API calls or webhook endpoint changes
Watch for anomalous account registrations followed by immediate wp-admin activity

How to Mitigate CVE-2026-7753

Immediate Actions Required

Update the Cost Calculator Builder plugin to a version later than 3.6.17 that includes the capability check fix
Rotate all Stripe secret keys, PayPal client secrets, Razorpay secret keys, webhook secret keys, and reCAPTCHA secret keys stored in plugin calculators
Audit WordPress user accounts and disable or delete unrecognized Subscriber-level registrations
Review payment provider transaction and API logs for unauthorized activity dating back to plugin installation

Patch Information

The vendor addressed the issue in a subsequent release. Refer to the WordPress Plugin Changeset Report for the exact code changes applied to the export handler.

Workarounds

Disable the Cost Calculator Builder plugin until the patched version is deployed
Disable open user registration in WordPress settings to eliminate anonymous Subscriber creation
Restrict access to /wp-admin/admin-ajax.php for non-administrator roles at the web server or WAF layer
Add a WAF rule blocking POST requests where action=cost-calculator-custom-export-run originates from sessions lacking administrator capabilities

bash

# Example WAF rule (ModSecurity) blocking the vulnerable AJAX action
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1026753,\
   msg:'Block CVE-2026-7753 Cost Calculator Builder export'"
  SecRule ARGS:action "@streq cost-calculator-custom-export-run"