CVE-2024-6010 Cost Calculator Builder PRO <= 3.2.1 - Unauthenticated Price Manipulation

What is CVE-2024-6010?

CVE-2024-6010 is a medium-severity vulnerability in StylemixThemes Cost Calculator Builder PRO, published on 7 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Cost Calculator Builder PRO plugin for WordPress is vulnerable to price manipulation in all versions up to, and including, 3.2.1. This is due to the plugin allowing the price field to be manipulated prior to processing via the 'create_cc_order' function, called from the Cost Calculator Builder plugin. This makes it possible for unauthenticated attackers to manipulate the price of orders submitted via the calculator. Note: this vulnerability was partially patched with the release of Cost Calculator Builder version 3.2.17.

Weakness: CWE-472

Which versions are affected by CVE-2024-6010?

It affects 1 product.

Products include Stylemixthemes Cost Calculator Builder.

How do I fix CVE-2024-6010?

No fix has been published for CVE-2024-6010 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-6010 being exploited?

There is no known exploitation of CVE-2024-6010 in the wild and no public exploit code.

Other vulnerabilities in StylemixThemes Cost Calculator Builder PRO

• CVE-2024-43144 WordPress Cost Calculator Builder plugin <= 3.2.15 - SQL Injection vulnerability Critical 9.3
• CVE-2024-8379 Cost Calculator Builder < 3.2.29 - Admin+ SQL Injection High 7.2
• CVE-2024-10892 Cost Calculator Builder < 3.2.43 - Settings update via CSRF Medium 5.4
• CVE-2025-14757 Cost Calculator Builder <= 3.6.9 - Missing Authorization to Unauthenticated Payment Status Bypass Medium 5.3
• CVE-2024-6011 Cost Calculator Builder <= 3.2.12 - Authenticated (Administrator+) Stored Cross-Site Scripting Medium 4.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xrp5-mffj-h7gr.