CVE-2026-14900: RCE in Cost Calculator Builder PRO

CVE-2026-14900 affects the Cost Calculator Builder PRO plugin for WordPress in all versions up to 4.0.3. The vulnerability consists of insufficient sanitization of the orderDetails[*].originalValue field, injected without control into a calculator formula string passed to PHP eval() in the js_to_php() function. The allow-list filtering in evaluateFormula() does not block non-alphanumeric characters, allowing unauthenticated users to execute arbitrary code on the server.

Severity is maximum: CVSS 9.8 in critical category. The only protection is a nonce check, but the required nonce is emitted publicly on every front-end page via the wp_head hook, making it obtainable by any unauthenticated visitor. Signals on public research platforms indicate active interest in this flaw starting from November 2026.

Defensive action is immediate: update the plugin beyond version 4.0.3. Check WordPress administration logs (_access.log, error.log, security plugin audit logs) for patterns of anomalous requests to js_to_php between July and November 2026. Implement Web Application Firewall (WAF) with specific rules to block XOR payloads targeting this plugin pending update.