CVE-2026-97307: Cost Calculator Builder Info Disclosure

CVE-2026-97307 Overview

CVE-2026-97307 is a sensitive data exposure vulnerability in the StylemixThemes Cost Calculator Builder plugin for WordPress. The flaw is categorized as Insertion of Sensitive Information Into Sent Data [CWE-201] and affects all versions of cost-calculator-builder up to and including 4.0.17. An unauthenticated attacker can retrieve embedded sensitive data over the network without user interaction. The issue impacts WordPress sites running the vulnerable plugin and may expose confidential configuration or form data to remote parties.

Critical Impact
Unauthenticated remote attackers can retrieve embedded sensitive information from affected WordPress installations without any user interaction or privileges.

Affected Products

StylemixThemes Cost Calculator Builder plugin for WordPress
Versions from n/a through 4.0.17
WordPress sites with cost-calculator-builder installed and active

Discovery Timeline

2026-10-04 - CVE-2026-97307 published to the National Vulnerability Database (NVD)
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-97307

Vulnerability Analysis

The Cost Calculator Builder plugin inserts sensitive information into data that is sent to clients or external parties. This behavior aligns with [CWE-201: Insertion of Sensitive Information Into Sent Data]. Because the data is embedded in responses accessible over the network, an unauthenticated attacker can collect it by issuing standard HTTP requests to the WordPress site. The vulnerability does not require authentication, user interaction, or elevated privileges, which increases the attack surface for any public-facing site running the plugin.

Root Cause

The plugin embeds sensitive data into content, responses, or assets that are returned to unauthenticated requesters. The absence of proper filtering or access control around this data permits disclosure. Patchstack's advisory confirms the issue affects every version through 4.0.17.

Attack Vector

The attack vector is network-based and requires no authentication. An attacker sends HTTP requests to endpoints or pages exposed by the plugin and parses the responses for embedded sensitive data. Because no interaction is required from site administrators or users, mass scanning of WordPress sites running cost-calculator-builder is a plausible exploitation pattern. No public proof-of-concept exploit is currently listed, and the CVE is not present on the CISA Known Exploited Vulnerabilities catalog.

For technical specifics, review the Patchstack Vulnerability Advisory.

Detection Methods for CVE-2026-97307

Indicators of Compromise

Unusual volumes of unauthenticated GET requests targeting pages or endpoints that render the Cost Calculator Builder shortcode or assets.
Repeated access to cost-calculator-builder plugin assets under /wp-content/plugins/cost-calculator-builder/ from a narrow set of source IPs.
Requests to admin-ajax endpoints invoking Cost Calculator Builder actions from unauthenticated sessions.

Detection Strategies

Inventory WordPress sites and identify installations of cost-calculator-builder at version 4.0.17 or earlier.
Review web server access logs for scraping patterns against calculator-rendered pages.
Correlate WordPress REST API and admin-ajax.php traffic with external threat intelligence on WordPress plugin scanners.

Monitoring Recommendations

Enable web application firewall (WAF) logging for all requests to the plugin's endpoints and shortcode-rendered pages.
Alert on anomalous outbound data patterns from WordPress hosts that could indicate sensitive data scraping.
Monitor plugin version inventory continuously and flag any site running vulnerable versions of cost-calculator-builder.

How to Mitigate CVE-2026-97307

Immediate Actions Required

Identify all WordPress sites running cost-calculator-builder at version 4.0.17 or earlier.
Update the plugin to a fixed version once released by StylemixThemes, as noted in the Patchstack advisory.
Rotate any credentials, API keys, or tokens that may have been embedded in calculator configurations or responses.

Patch Information

At the time of publication, the Patchstack advisory lists all versions through 4.0.17 as affected. Administrators should consult the Patchstack Vulnerability Advisory and the StylemixThemes plugin changelog for the latest fixed release and apply updates across all WordPress deployments.

Workarounds

Deactivate the Cost Calculator Builder plugin until a patched version is available and deployed.
Restrict access to pages that render the calculator using authentication or IP allowlisting where feasible.
Deploy virtual patching rules at the WAF layer to block access to vulnerable plugin endpoints.

bash

# Audit WordPress installations for the vulnerable plugin version
wp plugin get cost-calculator-builder --field=version

# Deactivate the plugin as a temporary workaround
wp plugin deactivate cost-calculator-builder