CVE-2025-9243highCWE-862

CVE-2025-9243: fallo de gravedad alta en stylemix Cost Calculator Builder

Cost Calculator Builder <= 3.5.32 - Authenticated (Subscriber+) Missing Authorization via get_cc_orders/update_order_status Functions

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Cost Calculator Builder

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.1epss 0.3%
The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorizedmodification of data due to a missing capability check on the get_cc_orders and update_order_status functions in all versions up to, and including, 3.5.32. This makes it possible for authenticated attackers, with Subscriber-level access and above, to access order management functions and modify order status.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Productos afectados
stylemix · Cost Calculator Builder
CVEs relacionadas — stylemix Cost Calculator Builder

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-12529HIGHCost Calculator Builder <= 3.6.3 - Unauthenticated Arbitrary File DeletionEPSS 0.6%CVE-2026-10865MEDIUMCost Calculator Builder <= 4.0.11 - Unauthenticated Sensitive Information Exposure of Payment Gateway Secret KeysEPSS 0.6%CVE-2026-7753MEDIUMCost Calculator Builder <= 3.6.17 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information DisclosureEPSS 0.5%CVE-2024-6011MEDIUMCost Calculator Builder <= 3.2.12 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2025-2128MEDIUMCost Calculator Builder <= 3.2.67 - Authenticated (Subscriber+) SQL Injection via order_ids ParameterEPSS 0.4%CVE-2024-6012MEDIUMCost Calculator Builder <= 3.2.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content CreationEPSS 0.4%