The Cost Calculator Builder plugin for WordPress is affected by a missing capability check on the AJAX action "cost-calculator-custom-export-run", allowing any authenticated user with Subscriber-level access or higher to trigger the export_calculators handler. The handler validates only a nonce that is broadcast on all wp-admin pages, so an attacker can obtain a usable nonce from, for example, the profile page. With this, the attacker can download the full configuration of every calculator, exposing stored secrets such as Stripe, PayPal, Razorpay, and reCAPTCHA keys. This constitutes a sensitive information disclosure vulnerability defined by CWE-862.

This vulnerability exists in all releases of the Cost Calculator Builder plugin up to and including version 3.6.17. WordPress sites that install or update the plugin within this range are susceptible. The issue is tied to the plugin's export functionality and is not limited to a particular WordPress version or theme; any WordPress installation that has the vulnerable plugin and contains user accounts with Subscriber or higher roles is affected.

The CVSS score of 6.5 indicates a moderate severity. EPSS shows no available score, meaning no publicly recorded exploit data. The vulnerability is not listed in the CISA KEV catalog. Attackers only need authenticated access; no elevated privileges or remote code execution are required. Nevertheless, the exposed secrets could be used to compromise external payment services and messaging systems. Because the export action is triggered via an AJAX endpoint, the attack can be performed by simply visiting a crafted URL or by submitting a form from the admin area. The lack of privilege checks makes it easy for attackers who already have at least Subscriber role.