The Cost Calculator Builder plugin is vulnerable to a time‑based SQL injection (CWE‑89) through the order_ids parameter in all releases up to 3.2.67. The flaw arises from insufficient escaping of user input and lack of prepared statements. Because only authenticated users with Subscriber level or higher can supply the parameter, an attacker can inject additional SQL statements to extract sensitive data from the database.

WordPress installations running the Cost Calculator Builder plugin version 3.2.67 or older. The affected vendor is stylemix, and the plugin is distributed as a WordPress plugin.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation in the general population, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated request to the Payments endpoint using the order_ids field, where the attacker can craft a payload that delays response times or returns data from the database.