Horizon Alert
Summary of the vulnerability and why it matters
A critical vulnerability exists in the Cost Calculator Builder PRO WordPress plugin, allowing unauthenticated attackers to execute arbitrary code on the server. This is due to insufficient sanitization of input fields that are processed by a PHP `eval()` function, bypassing intended security checks. The ease of exploitation, with publicly available nonces, presents a significant risk.
- Unauthenticated attackers can run their own code.
- Affects a public-facing WordPress plugin.
- Confirm relevance and exposure of the plugin.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can leverage this vulnerability by visiting a WordPress site using the affected plugin. The attacker can then craft a malicious request containing specially formed input in the `orderDetails[*].originalValue` field. This input is processed by the `js_to_php` function, which fails to adequately sanitize the data before passing it to a PHP `eval()` call within the `evaluateFormula` function. This allows the attacker to execute arbitrary code on the server.
- Attacker needs no prior access.
- Triggered by submitting crafted form data.
- Allows arbitrary code execution on server.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow unauthenticated attackers to execute arbitrary code on the server hosting a WordPress site using the Cost Calculator Builder PRO plugin. The attack leverages insufficient sanitization in the `js_to_php` function, allowing malicious input to be passed to PHP's `eval()` function. Attackers can obtain the necessary nonce from publicly emitted data, bypassing authentication barriers.
- Server-side code execution.
- Via injected calculator formula.
- Compromise of site integrity.
Operational Fix
Recommended remediation, mitigation, and detection steps
Application owners and infrastructure teams managing WordPress sites are likely responsible for addressing this vulnerability. The immediate first step is to identify all instances of the affected plugin, confirm their reachability and business criticality, and then plan remediation.
- Application owners should own the issue.
- Verify plugin presence and accessibility.
- Plan coordinated maintenance for remediation.
