CVE-2025-14757: 
WordPress vulnerability analysis and mitigation

CVE-2025-14757 is an Unauthenticated Payment Status Bypass vulnerability in the Cost Calculator Builder plugin for WordPress, developed by StyleMixThemes. It affects all versions up to and including 3.6.9 of the free plugin, but only when used in combination with the Cost Calculator Builder PRO add-on. The vulnerability was published on January 16, 2026, and a patch was released on January 23, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium), assigned by Wordfence (Wordfence).

The root cause is a Missing Authorization flaw (CWE-862) in the plugin's AJAX payment completion handler. The complete_payment AJAX action is registered using WordPress's wp_ajax_nopriv hook, making it accessible to unauthenticated users. The complete() function in CCBOrderController.php only validates a nonce but does not verify user capabilities or confirm that the requester owns the order being modified. Critically, nonces are exposed to all site visitors via the window.ccb_nonces JavaScript object embedded in the page source, meaning any visitor can trivially obtain a valid nonce and submit a crafted AJAX request to mark any order as "completed" without making an actual payment (Wordfence, WordPress Trac).

Successful exploitation allows any unauthenticated attacker to fraudulently mark any order's payment status as "completed" without completing an actual payment transaction. This directly enables financial fraud and revenue loss for site operators, as goods or services could be obtained without payment. The vulnerability has no confidentiality or availability impact, but the integrity impact — manipulation of payment records — can be significant for e-commerce sites relying on this plugin combination (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.062%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication, no special privileges, and no user interaction, making it trivially exploitable by any visitor to an affected site once the nonce is retrieved from the page source (Wordfence).

1. Reconnaissance: Identify WordPress sites using the Cost Calculator Builder free plugin (version ≤ 3.6.9) in combination with Cost Calculator Builder PRO, using tools like WPScan or by inspecting page source for plugin-specific assets.
2. Retrieve the nonce: Visit any page on the target site that loads the Cost Calculator Builder widget and inspect the page source or browser console for the window.ccb_nonces JavaScript object to extract a valid nonce value.
3. Identify a target order: Determine an order ID to manipulate — this may be guessable (sequential integers) or observable through normal site interaction (e.g., placing a test order).
4. Craft the AJAX request: Send an HTTP POST request to the site's WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the action parameter set to complete_payment, the extracted nonce, and the target order ID.
5. Achieve payment bypass: The server processes the request, skips capability and ownership checks, and marks the specified order's payment status as "completed," allowing the attacker to claim goods or services without payment (Wordfence, WordPress Trac).

• Network: Unusual or repeated POST requests to /wp-admin/admin-ajax.php with action=complete_payment from unauthenticated sessions or unexpected IP addresses.
• Logs: WordPress access logs showing admin-ajax.php requests with complete_payment action from users with no associated session or login activity; multiple order completion events in a short timeframe from the same IP.
• Application: Orders in the Cost Calculator Builder PRO dashboard showing a "completed" payment status with no corresponding payment gateway transaction record or confirmation.

Update the Cost Calculator Builder free plugin to version 3.6.10 or later, which includes a patch that adds proper authorization checks to the complete() function in CCBOrderController.php. The patch was committed on January 23, 2026. No configuration-based workaround is available; upgrading is the only effective remediation. Site operators should also audit recent order records for suspicious payment status changes that may indicate prior exploitation (WordPress Trac Patch, Wordfence).

Wordfence, which discovered and reported the vulnerability, published a threat intelligence advisory detailing the flaw and its impact on affected WordPress sites. The vulnerability received standard coverage from automated CVE tracking services and security aggregators. No notable researcher commentary or significant social media discussion beyond routine CVE publication activity has been observed.