{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24363", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-01-22T14:42:32.872Z", "datePublished": "2026-03-25T16:14:31.370Z", "dateUpdated": "2026-04-28T16:14:48.378Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "WP_Estimation_Form", "product": "WP Cost Estimation & Payment Forms Builder", "vendor": "loopus", "versions": [{"changes": [{"at": "10.3.0", "status": "unaffected"}], "lessThanOrEqual": "10.3.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Phat RiO | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-22T14:18:46.562Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in loopus WP Cost Estimation & Payment Forms Builder WP_Estimation_Form allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects WP Cost Estimation & Payment Forms Builder: from n/a through < 10.3.0.</p>"}], "value": "Missing Authorization vulnerability in loopus WP Cost Estimation & Payment Forms Builder WP_Estimation_Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cost Estimation & Payment Forms Builder: from n/a through < 10.3.0."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:48.378Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/WP_Estimation_Form/vulnerability/wordpress-wp-cost-estimation-payment-forms-builder-plugin-10-3-0-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress WP Cost Estimation & Payment Forms Builder plugin < 10.3.0 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-26T19:45:08.398610Z", "id": "CVE-2026-24363", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T01:50:02.417Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24363", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-26T19:45:08.398610Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T19:44:44.153Z"}}], "cna": {"title": "WordPress WP Cost Estimation & Payment Forms Builder plugin < 10.3.0 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Phat RiO | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "loopus", "product": "WP Cost Estimation & Payment Forms Builder", "versions": [{"status": "affected", "changes": [{"at": "10.3.0", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "10.3.0"}], "packageName": "WP_Estimation_Form", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-22T14:18:46.562Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/WP_Estimation_Form/vulnerability/wordpress-wp-cost-estimation-payment-forms-builder-plugin-10-3-0-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in loopus WP Cost Estimation & Payment Forms Builder WP_Estimation_Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cost Estimation & Payment Forms Builder: from n/a through < 10.3.0.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in loopus WP Cost Estimation & Payment Forms Builder WP_Estimation_Form allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects WP Cost Estimation & Payment Forms Builder: from n/a through < 10.3.0.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-23T14:14:04.499Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24363", "state": "PUBLISHED", "dateUpdated": "2026-04-28T01:50:02.417Z", "dateReserved": "2026-01-22T14:42:32.872Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-03-25T16:14:31.370Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in loopus WP Cost Estimation & Payment Forms Builder WP_Estimation_Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cost Estimation & Payment Forms Builder: from n/a through < 10.3.0."}, {"lang": "es", "value": "Vulnerabilidad de autorizaci\u00f3n faltante en loopus WP Cost Estimation &amp; Payment Forms Builder WP_Estimation_Form permite la explotaci\u00f3n de niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a WP Cost Estimation &amp; Payment Forms Builder: desde n/a hasta &lt; 10.3.0."}], "id": "CVE-2026-24363", "lastModified": "2026-04-24T16:32:53.997", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "audit@patchstack.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2026-03-25T17:16:37.110", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/WP_Estimation_Form/vulnerability/wordpress-wp-cost-estimation-payment-forms-builder-plugin-10-3-0-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,10.3.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "WP Cost Estimation & Payment Forms Builder", "source": "cna", "vendor": "loopus"}, "product": "wp_cost_estimation_&_payment_forms_builder", "vendor": "loopus"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-26T22:38:03.757685+00:00", "value": {"mitigation_remediation": ["Upgrade the plugin to version 10.3.0 or later to remove the broken access control issue", "Verify that form access settings restrict visibility and editing rights to authorized administrator roles"], "summary": {"action": "Immediate Patch", "impact": "Broken Access Control permitting unauthorized access to forms and data"}, "threat_synthesis": {"affected_systems": "All installations of the loopus WP Cost Estimation & Payment Forms Builder plugin with a version number earlier than 10.3.0 are affected. Sites that have deployed the plugin without strict role\u2011based access restrictions will be vulnerable to this flaw.", "description_and_impact": "The vulnerability stems from a missing authorization check in the WP Cost Estimation & Payment Forms Builder plugin, allowing users with lower privileges than intended administrators to read, modify, or delete payment form data. This flaw is represented by CWE\u2011862 and can expose financial information and disrupt processes that rely on the integrity of the payment forms. The potential impact is limited to the data managed by the plugin but can result in significant loss of confidentiality and data integrity if an attacker leverages the exposed access.", "risk_and_exploitability": "The CVSS score of 7.5 indicates a high potential impact, though the EPSS score of less than 1% suggests that exploitation is currently uncommon. The plugin is not listed in the CISA KEV catalog. The likely attack vector is web access to the WordPress site where an attacker can submit requests that bypass the intended role checks; this inference is based on the description of a missing authorization defect. If the site's configuration allows permissive access, the risk is high, but the absence of such permissive settings reduces the likelihood of exploitation."}}}}, "created": "2026-03-25T21:34:51.628993+00:00", "updated": "2026-03-27T09:46:30.776853+00:00", "vendors": ["loopus", "loopus$PRODUCT$wp_cost_estimation_&_payment_forms_builder", "wordpress", "wordpress$PRODUCT$wordpress"]}