PT-2024-37313 · WordPress · Cost Calculator Builder

Andrea Bocchetti · Published 2024-09-07 · Updated 2024-10-23 · CVE-2024-6010

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Cost Calculator Builder PRO plugin for WordPress versions up to, and including, 3.2.1

Description: The Cost Calculator Builder PRO plugin for WordPress is vulnerable to price manipulation. This issue arises because the plugin allows the price field to be manipulated prior to processing via the create cc order function, which is called from the Cost Calculator Builder plugin. This makes it possible for unauthenticated attackers to manipulate the price of orders submitted via the calculator.

Recommendations: For versions up to, and including, 3.2.1, update to version 3.2.17 or later to partially patch this vulnerability. As a temporary workaround, consider restricting access to the create cc order function until a more comprehensive patch is available.

Fix

Weakness Enumeration

CWE-472

Related Identifiers

CVE-2024-6010

Affected Products

Cost Calculator Builder

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2024-6010 · Security Note
• https://osv.dev/vulnerability/CVE-2024-6010 · Vendor Advisory
• https://docs.stylemixthemes.com/cost-calculator-builder/changelog-1/changelog-pro-version · Note
• https://t.me/cvenotify/96155 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/fc04e676-e394-488e-a239-95af5f865613?source=cve · Note
• https://t.me/cvedetector/5020 · Telegram Post
• https://plugins.trac.wordpress.org/browser/cost-calculator-builder/trunk/frontend/dist/order.js · Note
• https://twitter.com/VulmonFeeds/status/1832426981029216752 · Twitter Post
• https://t.me/cvenotify/93673 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3172590 · Note
• https://twitter.com/CVEnew/status/1832382762466324646 · Twitter Post
• https://t.me/cvenotify/99215 · Telegram Post