CVE-2026-77765: Better Payment < 2.3.4 - Unauthenticated Payment Amount Manipulation
The Better Payment WordPress plugin before 2.3.4 does not validate the submitted payment amount server-side against the merchant's configured fixed price before building the gateway charge, allowing unauthenticated users to pay an arbitrary reduced amount for a fixed-price item.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Better Paymentto a version that resolves this vulnerability.Fixed in 2.3.4
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated user who can submit a payment request for a fixed-price item may be able to alter the amount paid. No account or prior authentication is required.
What must be true for an installation to be affected?
The site must use a Better Payment version before 2.3.4 and offer fixed-price items through the plugin. The vulnerable behavior occurs when the submitted amount is used to build the gateway charge without server-side comparison to the configured price.
What is the practical impact of exploitation?
An attacker could pay an arbitrarily reduced amount for a fixed-price item. This can result in underpayment for goods, services, or other items delivered after successful payment processing.
What can be done if updating is not immediately possible?
The provided information does not identify a workaround. Until the plugin is updated, review payment requests and gateway charges for amounts that do not match configured fixed prices.