A critical remote code execution vulnerability in the StylemixThemes Cost Calculator Builder PRO plugin allows unauthenticated attackers to compromise the server.

This flaw involves improper control of code generation, specifically CWE-94, where malicious input is passed to a PHP eval() function. Although the plugin utilizes a nonce for authentication, the required token is publicly available on front-end pages, effectively allowing unauthenticated exploitation.

The ability for an unauthenticated attacker to execute arbitrary code on the underlying server represents a total compromise of the application and potentially the entire hosting environment. With a CVSS score of 9.8, this vulnerability poses an extreme risk, including data theft, unauthorized modification of site content, and potential lateral movement within the network.

Immediate Action: Update the StylemixThemes Cost Calculator Builder PRO plugin to version 4.0.4 or higher immediately.

Proactive Monitoring: Monitor server logs for anomalous PHP execution patterns and inspect the site for any unauthorized files or modified configuration settings.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to detect and block malicious payloads targeting PHP eval() functions or known plugin exploit signatures.

Public Exploit Available: No (exploit_available: false)

Given the critical nature of this vulnerability and the ease of exploitation, immediate action is required. Organizations using this plugin must prioritize the update to version 4.0.4 to prevent potential full-system compromise.