Cost Calculator Builder <= 3.5.32 - Missing Authorization

Wordfence Intelligence   >   Vulnerability Database   >   Cost Calculator Builder <= 3.5.32 - Missing Authorization
5.3
Missing Authorization
CVE CVE-2025-62049
CVSS 5.3 (Medium)
Publicly Published October 15, 2025
Last Updated October 29, 2025
Researcher Jarno Vos (jarnovos)

Description

The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.5.32. This makes it possible for unauthenticated attackers to perform an unauthorized action.

References

Share

Vulnerability Details for Cost Calculator Builder

Cost Calculator Builder

Software Type Plugin
Software Slug cost-calculator-builder (view on wordpress.org)
Patched? Yes
Remediation Update to version 3.5.33, or a newer patched version
Affected Version
  • <= 3.5.32
Patched Version
  • 3.5.33

Recent vulnerabilities in Cost Calculator Builder

Cost Calculator Builder <= 3.6.17 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure
6.5
CVE-2026-7753
Aug 4, 2026
Researcher: momopon1415
Cost Calculator Builder <= 4.0.11 - Unauthenticated Sensitive Information Exposure of Payment Gateway Secret Keys
5.3
CVE-2026-10865
Jul 10, 2026
Researcher: oper999
Cost Calculator Builder <= 4.0.1 - Unauthenticated Price Manipulation and Insecure Direct Object Reference
5.3
CVE-2025-14755
May 12, 2026
Researcher: andrea bocchetti
Cost Calculator Builder <= 3.6.9 - Missing Authorization to Unauthenticated Payment Status Bypass
5.3
CVE-2025-14757
Jan 15, 2026
Researcher: andrea bocchetti
Cost Calculator Builder <= 3.6.3 - Unauthenticated Arbitrary File Deletion
8.8
CVE-2025-12529
Dec 1, 2025
Researcher: YC_Infosec
Cost Calculator Builder <= 3.5.32 - Authenticated (Subscriber+) Missing Authorization via get_cc_orders/update_order_status Functions
8.1
CVE-2025-9243
Oct 3, 2025
Researcher: Dmitrii Ignatyev
Cost Calculator Builder <= 3.2.74 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2025-48277
May 19, 2025
Researcher: Krugov Artyom
Cost Calculator Builder <= 3.2.65 - Unauthenticated SQL Injection
7.5
CVE-2025-39587
Apr 16, 2025
Researcher: Trương Hữu Phúc (truonghuuphuc)
Cost Calculator Builder <= 3.2.67 - Authenticated (Subscriber+) SQL Injection via order_ids Parameter
6.5
CVE-2025-2128
Apr 10, 2025
Researcher: mikemyers
Cost Calculator Builder <= 3.2.65 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-31414
Mar 29, 2025
Researcher: Trương Hữu Phúc (truonghuuphuc)
# Title CVE ID CVSS Researchers Date
1 Cost Calculator Builder <= 3.6.17 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure CVE-2026-7753 6.5 momopon1415 August 4, 2026
2 Cost Calculator Builder <= 4.0.11 - Unauthenticated Sensitive Information Exposure of Payment Gateway Secret Keys CVE-2026-10865 5.3 oper999 July 10, 2026
3 Cost Calculator Builder <= 4.0.1 - Unauthenticated Price Manipulation and Insecure Direct Object Reference CVE-2025-14755 5.3 andrea bocchetti May 12, 2026
4 Cost Calculator Builder <= 3.6.9 - Missing Authorization to Unauthenticated Payment Status Bypass CVE-2025-14757 5.3 andrea bocchetti January 15, 2026
5 Cost Calculator Builder <= 3.6.3 - Unauthenticated Arbitrary File Deletion CVE-2025-12529 8.8 YC_Infosec December 1, 2025
6 Cost Calculator Builder <= 3.5.32 - Authenticated (Subscriber+) Missing Authorization via get_cc_orders/update_order_status Functions CVE-2025-9243 8.1 Dmitrii Ignatyev October 3, 2025
7 Cost Calculator Builder <= 3.2.74 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2025-48277 4.4 Krugov Artyom May 19, 2025
8 Cost Calculator Builder <= 3.2.65 - Unauthenticated SQL Injection CVE-2025-39587 7.5 Trương Hữu Phúc (truonghuuphuc) April 16, 2025
9 Cost Calculator Builder <= 3.2.67 - Authenticated (Subscriber+) SQL Injection via order_ids Parameter CVE-2025-2128 6.5 mikemyers April 10, 2025
10 Cost Calculator Builder <= 3.2.65 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-31414 6.4 Trương Hữu Phúc (truonghuuphuc) March 29, 2025
View more vulnerabilities in this software package View more vulnerabilities

This record contains material that is subject to copyright.

Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.

Copyright 1999-2026 The MITRE Corporation

License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more.

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation