CVE-2024-6011 – The Cost Calculator Builder WordPress plugin ha... (How to Fix)

Q: What is the severity of CVE-2024-6011?

CVE-2024-6011 has a CVSS score of 4.4 (MEDIUM). The Cost Calculator Builder WordPress plugin has a stored XSS vulnerability that allows authenticated administrators to inject malicious scripts into website pages. These scripts execute when users visit the compromised pages, potentially stealing credentials or performing unauthorized actions. Only WordPress sites using vulnerable versions of this specific plugin are affected.

📋 TL;DR

The Cost Calculator Builder WordPress plugin has a stored XSS vulnerability that allows authenticated administrators to inject malicious scripts into website pages. These scripts execute when users visit the compromised pages, potentially stealing credentials or performing unauthorized actions. Only WordPress sites using vulnerable versions of this specific plugin are affected.

💻 Affected Systems

Products:

WordPress Cost Calculator Builder plugin

Versions: All versions up to and including 3.2.12

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires administrator-level access to exploit; affects all WordPress installations using vulnerable plugin versions.

📦 What is this software?

Cost Calculator Builder by Stylemixthemes

View all CVEs affecting Cost Calculator Builder →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Administrator account compromise leads to site takeover, data theft, malware distribution to visitors, and complete loss of website integrity.

🟠

Likely Case

Malicious administrator injects scripts to steal user session cookies, redirect visitors to phishing sites, or deface the website.

🟢

If Mitigated

With proper access controls and monitoring, impact is limited to potential data exposure from users visiting injected pages.

🌐 Internet-Facing: HIGH

🏢 Internal Only: LOW

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires administrator credentials; proof-of-concept details are publicly available in references.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 3.2.13 or later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3108606/

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Cost Calculator Builder' and click 'Update Now'. 4. Verify version is 3.2.13 or higher.

🔧 Temporary Workarounds

Remove vulnerable plugin

all

Temporarily disable or remove the Cost Calculator Builder plugin until patched.

wp plugin deactivate cost-calculator-builder
wp plugin delete cost-calculator-builder

Restrict administrator access

all

Limit administrator accounts to trusted personnel only and implement multi-factor authentication.

🧯 If You Can't Patch

Implement web application firewall with XSS protection rules
Regularly audit administrator accounts and monitor for suspicious activity

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel → Plugins → Cost Calculator Builder → Version. If version is 3.2.12 or lower, system is vulnerable.

Check Version:

wp plugin get cost-calculator-builder --field=version

Verify Fix Applied:

After update, confirm version is 3.2.13 or higher in plugin details.

📡 Detection & Monitoring

Log Indicators:

Unusual administrator activity modifying calculator fields
HTTP requests containing suspicious script tags in 'textarea.description' parameter

Network Indicators:

Unexpected JavaScript execution from calculator pages
External script loads from calculator form submissions

SIEM Query:

source="wordpress.log" AND "textarea.description" AND ("<script>" OR "javascript:")

📊 Metadata

CVE ID: CVE-2024-6011

CVSS v3 Score: 4.4 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

CWE: CWE-79

Published: July 2, 2024

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-6011, you might also want to check these: