CVE-2026-10865

The Cost Calculator Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.11 via the (template body). This makes it possible for unauthenticated attackers to extract the plaintext Stripe secret key, Razorpay secret key, and PayPal client_secret embedded in the page source of any page containing a calculator, enabling full control of the merchant's payment gateway accounts. This exposure only occurs when the 'use in all calculators' option is enabled for one or more payment gateways in the plugin's global settings.

• CWE-200

• https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/3.6.17/includes/functions.php#L748
• https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/3.6.17/templates/frontend/render.php#L28
• https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/3.6.17/templates/frontend/render.php#L281
• https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/3.6.17/templates/frontend/render.php#L61
• https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/4.0.5/includes/functions.php#L748
• https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/4.0.5/templates/frontend/render.php#L28
• https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/4.0.5/templates/frontend/render.php#L281
• https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/4.0.5/templates/frontend/render.php#L61
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3578557%40cost-calculator-builder&new=3578557%40cost-calculator-builder
• https://www.wordfence.com/threat-intel/vulnerabilities/id/29de766d-5e7e-46b4-acac-feec5b33589e?source=cve

Published

Jul 11, 2026

Last Modified

Jul 13, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1086The Font Pairing Preview For Landing Pages plugin for WordPr…4.3
• CVE-2026-10860A logic error in the MISP CRUD component delete handler allo…6.5
• CVE-2026-10861An open redirect vulnerability existed in MISP UsersControll…6.1
• CVE-2026-10862The Accordions plugin for WordPress is vulnerable to Stored …6.4
• CVE-2026-10863A security issue was fixed in the correlations over-correlat…8.1
• CVE-2026-10864A vulnerability in the MISP dashboard widgets allowed an aut…4.3
• CVE-2026-10868A mass assignment vulnerability exists in the MISP user edit…9
• CVE-2026-1087The Guardian News Feed plugin for WordPress is vulnerable to…4.3
• CVE-2026-10870A flaw has been found in Shibby Tomato 1.28.0000. This affec…7.3
• CVE-2026-10871A vulnerability has been found in Shibby Tomato 1.28.0000. T…7.3
• CVE-2026-10872A vulnerability was found in Shibby Tomato 1.28.0000. This i…7.3
• CVE-2026-10873A vulnerability was determined in Shibby Tomato 1.28.0000. I…7.3