StylemixThemes Cost Calculator Builder PRO: remote code execution

StylemixThemes Cost Calculator Builder PRO

The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.3 via the js_to_php function. This is due to insufficient sanitization of the orderDetails[*].originalValue field, which is injected verbatim into a calculator formula string passed to PHP eval() inside…

Still cooking for Cost Calculator Builder PRO.

First seen: 2 Nov 2026
Last update: 2 Nov 2026, 07:17 UTC
Identifiers: CVE-2026-14900
CVSS: 9.8
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## StylemixThemes Cost Calculator Builder PRO: remote code execution
Severity: critical. Patch status: fix status unknown.
Affected: StylemixThemes Cost Calculator Builder PRO
Ids: CVE-2026-14900

The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.3 via the js_to_php function. This is due to insufficient sanitization of the orderDetails[*].originalValue field, which is injected verbatim into a calculator formula string passed to PHP eval() inside…

## Steps
1. Search the repo, its CI and infra config for StylemixThemes Cost Calculator Builder PRO. If present, report the version in use and whether it's affected.
2. Cost Calculator Builder PRO <= 4.0.3: the CVE record names no fix; check the vendor advisory before assuming there is none. Until one ships: restrict network access to it.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Cost Calculator Builder PRO <= 4.0.3 | not named in the CVE record | check the vendor advisory: https://stylemixthemes.com/cost-calculator-plugin/ | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-14900") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://nvd.nist.gov/vuln/detail/CVE-2026-14900 https://stylemixthemes.com/cost-calculator-plugin/
https://pwned.coffee/i/the-cost-calculator-builder-pro-plugin-for-wordpress-is-cve-2026-14900

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
Cost Calculator Builder PRO <= 4.0.3 fix not named in the CVE record: see vendor advisory CVE record (CNA) checked 3 Nov
The CVE record names no fix for one line; the vendor’s advisory may: stylemixthemes.com
Score: CVSS 9.8 (critical). CVSS 3.1 9.8 (CNA Wordfence) for CVE-2026-14900
Last checked: 3 Nov 2026, 20:33 UTC

Product	Affected	Fixed in	Source
Cost Calculator Builder PRO	<= 4.0.3	fix not named in the CVE record: see vendor advisory	CVE record (CNA) checked 3 Nov

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Totalone very hot coffee