The Cost Calculator Builder plugin allows unauthenticated users to trigger a complete_payment AJAX action that is registered with wp_ajax_nopriv. The action validates only a publicly exposed nonce and does not verify that the caller has the required capabilities or that the order belongs to the caller. This access control weakness enables any visitor to set any order’s status to "completed" without having performed a payment.

The vulnerability exists in both the free and PRO editions of the Cost Calculator Builder plugin released by Stylemix for WordPress. All versions up to and including 3.6.9 are affected when the PRO add‑on is present on a site.

The CVSS score of 5.3 indicates a medium severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. An attacker can exploit the flaw simply by sending an unauthenticated HTTP request to the wp-admin/admin-ajax.php endpoint with action=complete_payment and a valid nonce, thereby marking orders as paid without authorization. The vulnerability does not enable arbitrary code execution but can result in financial loss and inventory mismanagement.