Is CVE-2024-6010 actively exploited?

No active exploitation of CVE-2024-6010 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2024-6010 be exploited remotely?

Yes. CVE-2024-6010 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2024-6010?

CVE-2024-6010 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2024-6010

MEDIUM

CVE-2024-6010

CWE-472Published: September 7, 2024· Updated: Jun 17, 2026

5.3

CVSS v3.1

Official Description

The Cost Calculator Builder PRO plugin for WordPress is vulnerable to price manipulation in all versions up to, and including, 3.2.1. This is due to the plugin allowing the price field to be manipulated prior to processing via the 'create_cc_order' function, called from the Cost Calculator Builder plugin. This makes it possible for unauthenticated attackers to manipulate the price of orders submitted via the calculator. Note: this vulnerability was partially patched with the release of Cost Calculator Builder version 3.2.17.

NVD Source

Technical Analysis

CVE-2024-6010 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.