The Cost Calculator Builder WordPress plugin contains a missing capability check on its get_cc_orders and update_order_status functions. This flaw allows any authenticated user with Subscriber‑level access or higher to read and change order data, letting an attacker modify the status of orders they do not own or should not manage. The impact is the unauthorized alteration of order information, which can disrupt customer workflows, financial processing, and inventory handling.

The affected product is Stylemix Cost Calculator Builder. All released versions up to and including 3.5.32 are vulnerable. Organizations using any of these versions without upgrading face the described risk.

The CVSS score of 8.1 classifies the issue as high severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, because the flaw requires only authenticated access at the Subscriber level, the risk remains significant for sites with many such users or where order management is critical.