The Cost Calculator Builder PRO plugin for WordPress contains a critical Remote Code Execution vulnerability affecting all versions up to and including 4.0.3. The flaw exists in the js_to_php function, where the orderDetails[*].originalValue field is insufficiently sanitized and injected verbatim into a formula string evaluated by PHP's eval() function. The regex allow-list in evaluateFormula() only filters alphanumeric tokens, leaving non-word punctuation characters unfiltered. The only authentication barrier is a nonce check, but the nonce is publicly exposed on every front-end page via the wp_head hook, making it freely obtainable by unauthenticated visitors. This effectively allows unauthenticated attackers to execute arbitrary code on the server. Attackers must craft payloads using non-word XOR gadgets to bypass the sanitization. The vulnerability carries a critical risk profile due to its unauthenticated nature and full code execution impact.