Description
The Better Payment WordPress plugin before 2.3.4 does not validate the submitted payment amount server-side against the merchant's configured fixed price before building the gateway charge, allowing unauthenticated users to pay an arbitrary reduced amount for a fixed-price item.
Published: 2026-09-23
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthenticated manipulation of payment amounts resulting in financial loss
Action: Update Plugin
AI Analysis

Impact

The Better Payment WordPress plugin before version 2.3.4 fails to validate the amount submitted by a user against the merchant’s fixed price on the server side. This flaw allows an unauthenticated user to submit an arbitrary, lower charge for a fixed‑price item. The consequence is that customers can pay less than the intended amount, causing revenue loss and damaging trust. The weakness is an access control failure (CWE-284).

Affected Systems

WordPress sites that have the Better Payment plugin installed with a version earlier than 2.3.4 are affected. Any installation presenting the fixed‑price payment interface without upgrading the plugin is vulnerable.

Risk and Exploitability

The vulnerability’s CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, and the flaw is not in the CISA KEV catalog. Likely attack vector is a simple web request to the payment form, requiring no credentials. Exploitation is straightforward for anyone who can reach the plugin’s payment endpoint, potentially impacting the merchant’s revenue stream.

Generated by OpenCVE AI on September 23, 2026 at 14:34 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Better Payment plugin to version 2.3.4 or later to restore server‑side amount validation.
  • If an upgrade cannot be performed immediately, block or remove the parameter that accepts client‑supplied amounts from the front‑end request (e.g., via .htaccess or firewall rules) to prevent manipulation.
  • Verify that your payment-processing code enforces the fixed price on the server; review custom hooks or overrides in the plugin that may bypass the built‑in check.

Generated by OpenCVE AI on September 23, 2026 at 14:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 23 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
Description The Better Payment WordPress plugin before 2.3.4 does not validate the submitted payment amount server-side against the merchant's configured fixed price before building the gateway charge, allowing unauthenticated users to pay an arbitrary reduced amount for a fixed-price item.
Title Better Payment < 2.3.4 - Unauthenticated Payment Amount Manipulation
Weaknesses CWE-284
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-09-23T11:00:05.130Z

Reserved: 2026-08-21T10:44:32.094Z

Link: CVE-2026-77765

cve-icon Vulnrichment

Updated: 2026-09-23T10:38:48.016Z

cve-icon NVD

Status : Received

Published: 2026-09-23T06:17:01.827

Modified: 2026-09-23T11:17:11.270

Link: CVE-2026-77765

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T14:45:05Z

Weaknesses