The Cost Calculator Builder PRO plugin suffers from a code injection flaw in the js_to_php function. The orderDetails[*].originalValue field is inserted verbatim into a string that is passed to PHP eval(), and the only filtering performed is a whitelist of alphanumeric tokens, leaving punctuation and other characters untouched. This handling corresponds to CWE‑94. When an attacker supplies crafted payloads, they can execute arbitrary code on the web server, giving full control of the WordPress installation. The vulnerability is triggered by an HTTP request that contains the orderDetails payload; the only authentication check is a nonce that is publicly emitted on every front‑end page through wp_head, making the attack truly unauthenticated.

Affected systems are WordPress sites that have the StylemixThemes Cost Calculator Builder PRO plugin installed at any version up to and including 4.0.3. The plugin reads order details from the user interface and passes them to eval without proper sanitization, so every instance of the plugin running a vulnerable version is susceptible to exploitation.

Risk assessment shows a CVSS score of 9.8, indicating a critical impact level. The EPSS score of less than 1% suggests that, as of this analysis, exploit activity is low, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, the attack path is straightforward: an unauthenticated user can retrieve the required nonce from the page source, submit a crafted orderDetails payload via form input or API call, and trigger PHP eval(), achieving code execution. The low complexity and high impact make it a high-priority concern for any site running a vulnerable plugin version.