Cost Calculator Builder <= 3.6.9 - Missing Authorization to Unauthenticated Payment Status Bypass

This research plan outlines the methodology for exploiting CVE-2025-14757, a Missing Authorization vulnerability in the Cost Calculator Builder plugin.

1. Vulnerability Summary

The Cost Calculator Builder plugin (specifically when paired with the PRO version) registers an AJAX action complete_payment via wp_ajax_nopriv_complete_payment, making it accessible to unauthenticated users. The handler function for this action (likely complete() in a payment-related class) verifies a WordPress nonce but fails to perform any capability checks or verify if the requester has ownership of the order. Because the required nonce is globally exposed in the frontend source code via the ccb_nonces JavaScript object, any visitor can mark any order as "completed" without performing an actual payment.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• AJAX Action: complete_payment
• HTTP Method: POST
• Authentication: None (Unauthenticated)
• Vulnerable Parameter: order_id (inferred) or id (inferred)
• Nonce Parameter: nonce (referenced in the description)
• Preconditions:
  1. Cost Calculator Builder (Base) <= 3.6.9 installed.
  2. Cost Calculator Builder PRO installed and active.
  3. At least one order must exist in the system (e.g., in "pending" status).

3. Code Flow (Inferred)

1. Entry: An unauthenticated POST request is sent to admin-ajax.php?action=complete_payment.
2. Hook: WordPress matches the wp_ajax_nopriv_complete_payment hook to a handler function (likely in an Orders or Payment controller).
3. Nonce Check: The handler calls check_ajax_referer( 'ccb_nonce', 'nonce' ) (action string inferred). This passes because the nonce is publicly available.
4. Authorization Failure: The code proceeds to update the order status without calling current_user_can() or checking if the order belongs to the current session/user.
5. State Change: The handler calls a database update (likely via $wpdb) to change the order's status column to completed or paid.

4. Nonce Acquisition Strategy

The vulnerability description explicitly identifies the nonce source.

1. Identify Page: Find a page containing a Cost Calculator (usually uses shortcode [cost_calculator] or [cc_builder]).
2. Navigate: Use browser_navigate to visit that page.
3. Extract: Use browser_eval to extract the nonce from the localized script object.
   • JavaScript Command: window.ccb_nonces?.ccb_nonce (or similar key within the ccb_nonces object).
   • Localization Key: ccb_nonces (from source).

5. Exploitation Strategy

1. Setup Environment: Ensure both CCB and CCB PRO are active.
2. Create Target Order: Use the frontend calculator to submit a "booking" or "order" that results in a "Pending" status. Note the Order ID.
3. Retrieve Nonce: Navigate to any page with the calculator and extract the nonce from window.ccb_nonces.
4. Craft Exploit Request:
   • URL: http://localhost:8080/wp-admin/admin-ajax.php
   • Method: POST
   • Headers: Content-Type: application/x-www-form-urlencoded
   • Body: action=complete_payment&nonce=[EXTRACTED_NONCE]&order_id=[TARGET_ORDER_ID] (Note: parameter names like order_id should be verified via grep in the plugin source if available).
5. Execute: Send the request using http_request.

6. Test Data Setup

1. Calculator Creation: Create a simple calculator with a total and a "Submit" or "Payment" button.
2. Shortcode Placement:

   wp post create --post_type=page --post_title="Payment Test" --post_status=publish --post_content='[cost_calculator id="1"]'
   

3. Order Generation: Navigate to the page, fill out the calculator, and submit it to generate a "Pending" order.
4. Order ID Discovery:

   # Check the database for the last created order ID and its status
   wp db query "SELECT id, status FROM wp_ccb_orders ORDER BY id DESC LIMIT 1"
   

7. Expected Results

• HTTP Response: A success code (e.g., 200 OK) and potentially a JSON response like {"success": true} or 1.
• System Impact: The order status in the WordPress database for the specified order_id transitions from pending (or similar) to completed.

8. Verification Steps

After sending the AJAX request, verify the database state using WP-CLI:

# Verify the status change
wp db query "SELECT id, status FROM wp_ccb_orders WHERE id = [TARGET_ORDER_ID]"

• Success Criteria: Status is "completed" or "paid".

9. Alternative Approaches

• Parameter Guessing: If order_id is not the correct key, try id, order, or payment_id.
• Action String Verification: If ccb_nonce is not the correct key in the ccb_nonces object, inspect the full object using browser_eval("window.ccb_nonces") to find the relevant key.
• Database Inspection: If the table name wp_ccb_orders is incorrect, use wp db tables | grep ccb to find the correct table name for order tracking.