CVE-2026-77765

MediumCVSS 5.3

Published: 23/09/2026(UTC)Updated: 23/09/2026(UTC)Translated: 23/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

11th percentile - higher than 11% of all known CVEs

Summary

The Better Payment WordPress plugin before version 2.3.4 does not validate the submitted payment amount server-side against the merchant's configured fixed price before building the gateway charge, allowing unauthenticated users to pay an arbitrary reduced amount for a fixed-price item.

Risk Assessment

Attackers can pay less than the set price, leading to financial loss for the merchant.

Recommendation

Update the Better Payment plugin to version 2.3.4 or later, which includes the amount validation fix.

Other vulnerabilities in Better Payment

CVE-2026-57364Medium
The Better Payment plugin for WordPress contains a vulnerability due to improper validation of specified quantity in input, allowing an attacker to access functionality not properly constrained by ACLs. This issue affects versions up to and including 2.2.0.

Original NVD description (English source)

The Better Payment WordPress plugin before 2.3.4 does not validate the submitted payment amount server-side against the merchant's configured fixed price before building the gateway charge, allowing unauthenticated users to pay an arbitrary reduced amount for a fixed-price item.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS