[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fqzfYe0W0YuS4dSN5fnMLkCvjB5LWIPl9lvMgs6rgp0U":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":27,"research_verified":28,"research_rounds_completed":29,"research_plan":30,"research_summary":31,"research_vulnerable_code":9,"research_fix_diff":32,"research_exploit_outline":33,"research_model_used":34,"research_started_at":35,"research_completed_at":36,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":28,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":28,"source_links":37},"CVE-2026-10865","cost-calculator-builder-unauthenticated-sensitive-information-exposure-of-payment-gateway-secret-keys","Cost Calculator Builder \u003C= 4.0.11 - Unauthenticated Sensitive Information Exposure of Payment Gateway Secret Keys","The Cost Calculator Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.11 via the (template body). This makes it possible for unauthenticated attackers to extract the plaintext Stripe secret key, Razorpay secret key, and PayPal client_secret embedded in the page source of any page containing a calculator, enabling full control of the merchant's payment gateway accounts. This exposure only occurs when the 'use in all calculators' option is enabled for one or more payment gateways in the plugin's global settings.","cost-calculator-builder",null,"\u003C=4.0.11","4.0.12","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N","Exposure of Sensitive Information to an Unauthorized Actor","2026-07-10 17:35:16","2026-07-11 05:35:46",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F29de766d-5e7e-46b4-acac-feec5b33589e?source=api-prod",1,[22,23,24,25,26],"cost-calculator-builder.php","frontend\u002Fvue3\u002Fdist\u002Fassets\u002FAppearanceHeader-D59q3sMP.js","frontend\u002Fvue3\u002Fdist\u002Fassets\u002FAppearanceHeader-D59q3sMP.js.map","frontend\u002Fvue3\u002Fdist\u002Fassets\u002FBadge.vue_vue_type_script_setup_true_lang-CTWDxomc.js","frontend\u002Fvue3\u002Fdist\u002Fassets\u002FBadge.vue_vue_type_script_setup_true_lang-CTWDxomc.js.map","researched",false,3,"# Exploitation Research Plan - CVE-2026-10865\n\n## 1. Vulnerability Summary\nThe **Cost Calculator Builder** plugin (\u003C= 4.0.11) is vulnerable to **Sensitive Information Exposure**. The plugin exposes payment gateway secret keys (Stripe, Razorpay, and PayPal) in the HTML source code of any page where a calculator is embedded. This occurs when the \"use in all calculators\" option is enabled in the global settings, causing the plugin to localize sensitive configuration data to the frontend JavaScript context without filtering out secrets.\n\n## 2. Attack Vector Analysis\n- **Endpoint**: Any public-facing page or post containing a `[cost_calculator]` shortcode.\n- **Method**: Unauthenticated `GET` request.\n- **Precondition**: \n    1. A payment gateway (Stripe, Razorpay, or PayPal) must be configured in the plugin settings.\n    2. The \"use in all calculators\" option for that gateway must be enabled.\n    3. At least one calculator must be published on a page.\n- **Authentication**: None required.\n\n## 3. Code Flow Trace\nThe vulnerability stems from how settings are passed from the server to the frontend Vue.js components.\n1. **Entry Point**: A user visits a page with the `[cost_calculator]` shortcode.\n2. **Shortcode Handling**: `CCBEmbedCalculator` or `CCBFrontController` (likely inside `includes\u002Fclasses\u002FCCBFrontController.php`) processes the shortcode and enqueues the necessary scripts.\n3. **Data Localization**: The plugin uses `wp_localize_script()` or `wp_add_inline_script()` to pass configuration data to the frontend.\n4. **The Sink**: The function responsible for gathering settings (likely inside `includes\u002Fclasses\u002FCCBSettingsData.php` or `CCBCalculatorsHandler.php`) retrieves the entire gateway configuration object from the database (`wp_options`).\n5. **The Bug**: If \"use in all calculators\" is enabled, the code does not sanitize the configuration object before passing it to the localization function, resulting in `secret_key` or `client_secret` being printed in the page source inside a JSON object.\n\n## 4. Nonce Acquisition Strategy\n**No nonce is required.** This is a passive information exposure vulnerability via a standard `GET` request.\n\n## 5. Test Data Setup\nTo reproduce the vulnerability, the environment must be configured as follows:\n1. **Configure Payment Gateway**:\n   ```bash\n   # Use WP-CLI to simulate setting up a Stripe gateway with a secret key\n   # The actual option name might be ccb_settings or ccb_payment_settings\n   # We will verify the exact option name in the research phase\n   wp option patch insert ccb_settings stripe_secret_key \"sk_test_51MzVulnerabilityTestKey\"\n   wp option patch insert ccb_settings stripe_use_global \"on\"\n   wp option patch insert ccb_settings razorpay_secret_key \"rzp_test_SecretKey123\"\n   wp option patch insert ccb_settings razorpay_use_global \"on\"\n   ```\n2. **Create a Calculator**:\n   - Use the plugin's internal methods or WP-CLI to ensure a calculator exists. (Default ID is usually 1).\n3. **Publish a Page**:\n   ```bash\n   wp post create --post_type=page --post_title=\"Payment Calculator\" --post_status=publish --post_content='[cost_calculator id=\"1\"]'\n   ```\n\n## 6. Exploitation Strategy\nThe exploitation is a two-step process: discovering where the data is localized and then extracting it.\n\n### Phase 1: Discovery\n1. Identify the localization variable name. We will search for `wp_localize_script` in the plugin directory.\n2. Search for the \"use in all calculators\" setting logic in `includes\u002Fclasses\u002FCCBSettingsData.php`.\n\n### Phase 2: Extraction\n1. **Request**:\n   ```http\n   GET \u002Fpayment-calculator\u002F HTTP\u002F1.1\n   Host: target.local\n   ```\n2. **Analysis**:\n   - Inspect the response body for `\u003Cscript>` tags.\n   - Look for common localization keys like `ccb_data`, `ccb_frontend_settings`, or `calc_data`.\n   - Search for the specific secret key strings (e.g., `sk_test_`, `rzp_test_`).\n\n## 7. Expected Results\nA successful exploit will find a JSON object in the page source similar to:\n```html\n\u003Cscript id=\"ccb-frontend-settings-js-extra\">\nvar ccb_data = {\n    \"payments\": {\n        \"stripe\": {\n            \"enabled\": \"on\",\n            \"publishable_key\": \"pk_test_...\",\n            \"secret_key\": \"sk_test_51MzVulnerabilityTestKey\",\n            \"use_global\": \"on\"\n        },\n        \"razorpay\": {\n            \"key_id\": \"rzp_test_...\",\n            \"key_secret\": \"rzp_test_SecretKey123\",\n            \"use_global\": \"on\"\n        }\n    }\n};\n\u003C\u002Fscript>\n```\n\n## 8. Verification Steps\n1. **Manual Check**: Perform a `GET` request to the page and grep for the secret:\n   ```bash\n   # In the tool context\n   http_request(url=\"http:\u002F\u002Flocalhost:8080\u002Fpayment-calculator\u002F\")\n   # Then grep the response for \"secret_key\"\n   ```\n2. **Internal Comparison**: Compare the value found in the HTML source with the value stored in the database:\n   ```bash\n   wp option get ccb_settings --format=json | jq .stripe_secret_key\n   ```\n\n## 9. Alternative Approaches\nIf the secrets are not in a standard `wp_localize_script` block:\n- Check if they are embedded as `data-` attributes on the calculator's container `div` (e.g., `\u003Cdiv id=\"ccb-container\" data-config=\"...\">`).\n- Check if the plugin fetches configuration via an unauthenticated AJAX\u002FREST endpoint (e.g., `wp-json\u002Fccb\u002Fv1\u002Fsettings?id=1`). If so, check that endpoint for the same lack of sanitization.\n- Use `browser_eval` to inspect the global window object: `browser_eval(\"window.ccb_data\")`.","The Cost Calculator Builder plugin for WordPress (\u003C= 4.0.11) exposes sensitive payment gateway secret keys (Stripe, Razorpay, and PayPal) in the HTML source code of pages containing a calculator. This exposure occurs when the 'use in all calculators' option is enabled in the global settings, allowing unauthenticated attackers to extract plaintext credentials and gain control over the site owner's merchant accounts.","--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcost-calculator-builder\u002F4.0.11\u002Fcost-calculator-builder.php\t2026-06-17 14:49:56.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcost-calculator-builder\u002F4.0.12\u002Fcost-calculator-builder.php\t2026-06-19 11:48:48.000000000 +0000\n@@ -8,7 +8,7 @@\n  * License: GNU General Public License v2 or later\n  * License URI: http:\u002F\u002Fwww.gnu.org\u002Flicenses\u002Fgpl-2.0.html\n  * Text Domain: cost-calculator-builder\n- * Version: 4.0.11\n+ * Version: 4.0.12\n  *\u002F\n \n if ( ! defined( 'ABSPATH' ) ) {\n@@ -17,7 +17,7 @@\n \n define( 'CALC_DIR', __DIR__ );\n define( 'CALC_FILE', __FILE__ );\n-define( 'CALC_VERSION', '4.0.11' );\n+define( 'CALC_VERSION', '4.0.12' );\n define( 'CALC_WP_TESTED_UP', '7.0' );\n define( 'CALC_DB_VERSION', '4.0.0' );\n define( 'CALC_PATH', dirname( CALC_FILE ) );\n... (truncated)","1. Target Identification: Locate a WordPress site running Cost Calculator Builder (\u003C= 4.0.11) with a calculator embedded on a public page.\n2. Source Inspection: Access the page as an unauthenticated visitor and view the HTML source code.\n3. Data Localization Hunt: Search for JavaScript blocks containing localized configuration data (e.g., searching for keys like 'ccb_data', 'calc_data', or 'secret_key').\n4. Credential Extraction: When the 'use in all calculators' setting is enabled globally for payment providers, the plugin includes the full gateway configuration object in the frontend JS context. Extract the plaintext values for 'stripe_secret_key', 'razorpay_secret_key', or 'paypal_client_secret' from the JSON object.","gemini-3-flash-preview","2026-07-15 08:14:15","2026-07-15 08:15:11",{"type":38,"vulnerable_version":39,"fixed_version":11,"vulnerable_browse":40,"vulnerable_zip":41,"fixed_browse":42,"fixed_zip":43,"all_tags":44},"plugin","4.0.11","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcost-calculator-builder\u002Ftags\u002F4.0.11","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcost-calculator-builder.4.0.11.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcost-calculator-builder\u002Ftags\u002F4.0.12","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcost-calculator-builder.4.0.12.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcost-calculator-builder\u002Ftags"]