CVE-2024-6010

Katalog CVE

CVSS 5.3 · Medium EPSS 0,42%

Kerentanan External Control of Assumed-Immutable Web Parameter pada stylemixthemes cost calculator builder. Skor CVSS 3.1 5.3 (Medium) menurut wordfence.com.

Deskripsi (NVD)

The Cost Calculator Builder PRO plugin for WordPress is vulnerable to price manipulation in all versions up to, and including, 3.2.1. This is due to the plugin allowing the price field to be manipulated prior to processing via the 'create_cc_order' function, called from the Cost Calculator Builder plugin. This makes it possible for unauthenticated attackers to manipulate the price of orders submitted via the calculator. Note: this vulnerability was partially patched with the release of Cost Calculator Builder version 3.2.17.

Rincian

Terbit di NVD

7 September 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber wordfence.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-472: External Control of Assumed-Immutable Web Parameter

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.wordfence.com/threat-intel/vulnerabilities/id/fc04e676-e394-488e-a239-95af5f865613?source=cve advisory pihak ketiga
• https://docs.stylemixthemes.com/cost-calculator-builder/changelog-1/changelog-pro-version
• https://plugins.trac.wordpress.org/browser/cost-calculator-builder/trunk/frontend/dist/order.js issue tracking
• https://plugins.trac.wordpress.org/changeset/3172590/