Is CVE-2025-14755 actively exploited?

No active exploitation of CVE-2025-14755 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2025-14755 be exploited remotely?

Yes. CVE-2025-14755 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2025-14755?

CVE-2025-14755 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2025-14755

MEDIUM

CVE-2025-14755

CWE-862Published: May 13, 2026· Updated: May 13, 2026

5.3

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:10.0th

Official Description

The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Price Manipulation and Insecure Direct Object Reference (IDOR) in all versions up to, and including, 4.0.1 only when used in combination with Cost Calculator Builder PRO. This is due to the ccb_woocommerce_payment AJAX action being registered via wp_ajax_nopriv, making it accessible to unauthenticated users, and the renderWooCommercePayment() function passing user-controlled data directly to CCBWooCheckout::init() without authorization checks. This makes it possible for unauthenticated attackers to add WooCommerce products to their cart with attacker-controlled prices.

NVD Source

Technical Analysis

CVE-2025-14755 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.