CVE-2025-9243highCWE-862

CVE-2025-9243: falha de alta gravidade em stylemix Cost Calculator Builder

Cost Calculator Builder <= 3.5.32 - Authenticated (Subscriber+) Missing Authorization via get_cc_orders/update_order_status Functions

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Cost Calculator Builder

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.1epss 0.3%
The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorizedmodification of data due to a missing capability check on the get_cc_orders and update_order_status functions in all versions up to, and including, 3.5.32. This makes it possible for authenticated attackers, with Subscriber-level access and above, to access order management functions and modify order status.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
stylemix · Cost Calculator Builder
CVEs relacionadas — stylemix Cost Calculator Builder

No mesmo produto, das mais perigosas para as menos.

CVE-2025-12529HIGHCost Calculator Builder <= 3.6.3 - Unauthenticated Arbitrary File DeletionEPSS 0.6%CVE-2026-10865MEDIUMCost Calculator Builder <= 4.0.11 - Unauthenticated Sensitive Information Exposure of Payment Gateway Secret KeysEPSS 0.6%CVE-2026-7753MEDIUMCost Calculator Builder <= 3.6.17 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information DisclosureEPSS 0.5%CVE-2024-6011MEDIUMCost Calculator Builder <= 3.2.12 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2025-2128MEDIUMCost Calculator Builder <= 3.2.67 - Authenticated (Subscriber+) SQL Injection via order_ids ParameterEPSS 0.4%CVE-2024-6012MEDIUMCost Calculator Builder <= 3.2.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content CreationEPSS 0.4%