← Back

CVE-2024-6010

nvd nist
Published: Sep 7, 2024Modified: Oct 23, 2024

JSON object

Loading...
5.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Exploitability: 3.9 / Impact: 1.4
Source: security@wordfence.com (Secondary)

Description

The Cost Calculator Builder PRO plugin for WordPress is vulnerable to price manipulation in all versions up to, and including, 3.2.1. This is due to the plugin allowing the price field to be manipulated prior to processing via the 'create_cc_order' function, called from the Cost Calculator Builder plugin. This makes it possible for unauthenticated attackers to manipulate the price of orders submitted via the calculator. Note: this vulnerability was partially patched with the release of Cost Calculator Builder version 3.2.17.

Affected (1)

Stylemixthemes
1 product
Cost Calculator Builder
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Cost Calculator Builder
Up to 3.1.96

Related CWEs

CWE-472
External Control of Assumed-Immutable Web Parameter
The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.

References (4)

Source: security@wordfence.com
Source: security@wordfence.com
Issue Tracking
Source: security@wordfence.com
Source: security@wordfence.com
Third Party Advisory

Timeline

No history available yet.