PT-2024-32861 · WordPress · Cost Calculator Builder

István Márton · Published 2024-06-19 · Updated 2024-06-20 · CVE-2024-4787

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Cost Calculator Builder PRO for WordPress versions up to, and including, 3.1.75

Description The issue arises from insufficient limitations on the email recipient and the content in the send pdf and the send pdf front functions, which are reachable via AJAX. This allows unauthenticated attackers to send emails with any content to any recipient.

Recommendations For versions up to, and including, 3.1.75, consider disabling the send pdf and send pdf front functions until a patch is available to prevent exploitation. Restrict access to AJAX endpoints that reach these functions to minimize the risk of arbitrary email sending.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2024-4787

Affected Products

Cost Calculator Builder

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-4787 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/035ada56-541d-47b3-8348-3401d94bb509?source=cve · Note
• https://t.me/cvenotify/83712 · Telegram Post
• https://docs.stylemixthemes.com/cost-calculator-builder/changelog-1/changelog-pro-version · Note