Description
The Cost Calculator Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.11 via the (template body). This makes it possible for unauthenticated attackers to extract the plaintext Stripe secret key, Razorpay secret key, and PayPal client_secret embedded in the page source of any page containing a calculator, enabling full control of the merchant's payment gateway accounts. This exposure only occurs when the 'use in all calculators' option is enabled for one or more payment gateways in the plugin's global settings.
Published: 2026-07-11
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Cost Calculator Builder plugin exposes payment‑gateway secret keys (Stripe, Razorpay, PayPal) in the rendered page source for all versions up to 4.0.11 download a page containing a calculator and view the plaintext secret keys, thereby gaining full control over the merchant’s payment accounts. This is a classic information‑disclosure flaw (CWE‑200).

Affected Systems

The flaw affects the Stylemix Cost Calculator Builder WordPress plugin. All releases from the earliest version through 4.0.11 are impacted because the template body renders the gateway credentials. WordPress sites that have the plugin installed and the ‘use in all calculators’ option enabled for any payment gateway are vulnerable.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate baseline risk. The EPSS score is below 1 %, meaning attacks are currently considered unlikely but still possible. The vulnerability is not listed in the CISA KEV catalog, and no public exploit has been disclosed. Attackers only need to view the page source on any publicly reachable calculator page, with no authentication required.

Generated by OpenCVE AI on July 29, 2026 at 09:18 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Cost Calculator Builder to a patched release (≥4.0.12).
  • Alternatively, disable the ‘use in all calculators’ setting or remove the embedded secret keys from the template files.
  • Ensure that gateway credentials are handled server‑side only and are not rendered into the page output.

Generated by OpenCVE AI on July 29, 2026 at 09:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 13 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 11 Jul 2026 06:30:00 +0000

Type Values Removed Values Added
Description The Cost Calculator Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.11 via the (template body). This makes it possible for unauthenticated attackers to extract the plaintext Stripe secret key, Razorpay secret key, and PayPal client_secret embedded in the page source of any page containing a calculator, enabling full control of the merchant's payment gateway accounts. This exposure only occurs when the 'use in all calculators' option is enabled for one or more payment gateways in the plugin's global settings.
Title Cost Calculator Builder <= 4.0.11 - Unauthenticated Sensitive Information Exposure of Payment Gateway Secret Keys
Weaknesses CWE-200
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-07-13T17:35:45.659Z

Reserved: 2026-06-04T14:10:06.318Z

Link: CVE-2026-10865

cve-icon Vulnrichment

Updated: 2026-07-13T17:35:41.683Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-29T09:30:18Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor