A critical code-injection flaw (CVSS 9.8) in StylemixThemes' Cost Calculator Builder PRO plugin reportedly lets unauthenticated attackers execute arbitrary PHP on the server through a calculator field that reaches eval().
What Is It
CVE-2026-14900 is a Remote Code Execution vulnerability (CWE-94, Improper Control of Generation of Code) in the Cost Calculator Builder PRO plugin for WordPress, disclosed by Wordfence on 2026-07-29.
According to the advisory, the bug lives in the plugin's js_to_php function. The orderDetails[*].originalValue field is described as insufficiently sanitized and injected verbatim into a calculator formula string that is then passed to PHP's eval() inside js_to_php(). Sanitization is handled by a regex filter in evaluateFormula(), which operates on word characters only: alphanumeric tokens are stripped, while non-word punctuation passes through intact. The filter is therefore narrower than the "allow-list" framing suggests; it constrains the alphanumeric portion of the input rather than restricting the character set as a whole. On that reading, a working payload would have to be constructed entirely from non-word XOR gadgets to survive the filter; the advisory does not publish a proof-of-concept, so the practical difficulty of building one is not established in the source material.
Why It Matters
The CVSS 3.1 base score is 9.8 CRITICAL, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network-reachable, low complexity, no privileges, no user interaction, with high confidentiality, integrity, and availability impact.
The only authentication barrier is a nonce check, and the advisory characterizes that barrier as largely ineffective: the required nonce is said to be publicly emitted on every front-end page via the wp_head hook. If that holds, any unauthenticated visitor could read it off the page and proceed, reducing exploitation to fetching a page, lifting the nonce, and sending a crafted request.
No CISA KEV entry was supplied for this CVE, so there is no confirmed active exploitation or federal required-action deadline in the source material.
What's Vulnerable
- Vendor: StylemixThemes
- Product: Cost Calculator Builder PRO (WordPress plugin)
- Affected versions: all versions up to and including 4.0.3 (semver,
<= 4.0.3) - Default status for other versions: unaffected
Patch Status
The NVD record is in Received status as of 2026-07-29 and lists no fixed version. No patched release is identified in the supplied data, and no CISA-mandated remediation action accompanies this CVE. Operators running 4.0.3 or earlier should track the vendor and Wordfence advisories below for a fixed build.
Sources
- NVD, CVE-2026-14900: https://nvd.nist.gov/vuln/detail/CVE-2026-14900
- Wordfence Threat Intelligence: https://www.wordfence.com/threat-intel/vulnerabilities/id/4c8f2872-06ff-41a2-b601-77a47470de0c?source=cve
- StylemixThemes; Cost Calculator plugin: https://stylemixthemes.com/cost-calculator-plugin/