CVE-2026-57364

MediumCVSS 6.5

Published: 13/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.35%

27th percentile - higher than 27% of all known CVEs

Summary

The Better Payment plugin for WordPress contains a vulnerability due to improper validation of specified quantity in input, allowing an attacker to access functionality not properly constrained by ACLs. This issue affects versions up to and including 2.2.0.

Risk Assessment

The organization is at risk of unauthorized access to payment, donation, and subscription functions, potentially leading to transaction manipulation, fund theft, or compromise of financial data integrity.

Recommendation

Immediately update the Better Payment plugin to a version newer than 2.2.0 if available, or apply temporary mitigations such as restricting plugin access via firewall rules and monitoring logs for suspicious activity.

Other vulnerabilities in Better Payment

CVE-2026-77765Medium
The Better Payment WordPress plugin before version 2.3.4 does not validate the submitted payment amount server-side against the merchant's configured fixed price before building the gateway charge, allowing unauthenticated users to pay an arbitrary reduced amount for a fixed-price item.

Original NVD description (English source)

Improper Validation of Specified Quantity in Input vulnerability in WPDeveloper Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More better-payment allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More: from n/a through <= 2.2.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS