The Better Payment WordPress plugin before 2.3.4 does not validate the submitted payment amount server-side against the merchant's configured fixed price before building the gateway charge, allowing…

Info

CVECVE-2026-77765

First seen2026-09-23 07:01 UTC

Disclosed2026-09-23 06:17 UTC

Last updated2026-09-23 07:01 UTC

Channel statusauto

Summary

The Better Payment WordPress plugin before 2.3.4 does not validate the submitted payment amount server-side against the merchant's configured fixed price before building the gateway charge, allowing unauthenticated users to pay an arbitrary reduced amount for a fixed-price item.

In-depth triage

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Sources

NVD DATABASE

Original Links

https://wpscan.com/vulnerability/932f8c74-1ded-40ee-b1fd-a328f3626f21/

Timeline

2026-09-23 nvd_ingest NVD