CVE-2024-6010 is a price manipulation vulnerability affecting all versions up to and including 3.2.1 of the Cost Calculator Builder PRO plugin for WordPress. Unauthenticated attackers can exploit this by manipulating the price field before processing through the 'create_cc_order' function, allowing them to alter order prices. Rated as Medium severity with a CVSS score of 5.3, this vulnerability has a low attack complexity and requires no user interaction, making it easily exploitable to impact data integrity (price manipulation). The partial patch in version 3.2.17 indicates the ease of exploitation and the need for a fix. There is currently no evidence of active exploitation, nor are there publicly available exploit modules for Metasploit or Nuclei. Community discussion and media coverage are minimal, suggesting low public awareness of this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 3.1.96CPE matchmatch criteria | cpe:2.3:a:stylemixthemes:cost_calculator_builder:*:*:*:*:pro:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.