The vulnerability in WPDeveloper Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More stems from insufficient validation of a quantity parameter supplied to the plugin’s internal functions. Because the ACL checks are not enforced correctly, a caller can supply a crafted quantity value that bypasses the intended access control, allowing them to execute privileged operations such as granting features or altering payments. The flaw is classified as CWE‑1284 and can compromise the confidentiality and integrity of a WordPress site, but it does not directly affect availability.

WordPress sites that have installed the Better Payment plugin up to and including version 2.2.0 are susceptible. Every copy of the plugin in that version range shares the same code path for quantity validation, so all sites using any release in this range remain vulnerable unless mitigated.

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score of less than 1 percent shows that the probability of exploitation in the wild is very low. The vulnerability is not listed in the CISA KEV catalog, so no active exploitation campaigns are documented. The likely attack vector is an HTTP request to a plugin endpoint that accepts the quantity parameter; the description does not specify an authentication requirement, so this exploitation may be possible either with or without authenticated access, though the exact conditions are not detailed in the data.