CVE-2026-77765 in Better Payment Plugin
Summary
by MITRE • 09/23/2026
The Better Payment WordPress plugin before 2.3.4 does not validate the submitted payment amount server-side against the merchant's configured fixed price before building the gateway charge, allowing unauthenticated users to pay an arbitrary reduced amount for a fixed-price item.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in the Better Payment WordPress plugin prior to version 2.3.4 represents a critical failure in server-side input validation and business logic enforcement. This flaw specifically affects transactions involving products with configured fixed prices, where the system is expected to charge customers an exact amount regardless of user input. The core technical deficiency lies in the absence of rigorous verification mechanisms when processing payment requests from unauthenticated users or any client interacting with the plugin's API endpoints. When a purchase request is submitted, the application accepts the payment amount provided by the client-side interface without cross-referencing it against the merchant-defined fixed price stored in the database configuration. This lack of server-side validation allows an attacker to manipulate the transaction payload, effectively bypassing the intended pricing logic and executing transactions at arbitrary, significantly reduced costs or even zero cost if manipulated appropriately within the payment gateway's tolerance limits.
From a technical perspective, this issue is classified under CWE-20 Improper Input Validation and more specifically aligns with CWE-840 Perform Incorrect Business Logic due to insufficient validation of business rules. The vulnerability exploits the trust placed in client-supplied data for financial calculations, assuming that frontend constraints are sufficient to prevent tampering. In reality, web applications must treat all user input as untrusted until proven otherwise by server-side checks. By failing to enforce the fixed price constraint during the charge building phase, the plugin creates a direct path for economic exploitation. An attacker can intercept the HTTP request using tools such as Burp Suite or OWASP ZAP and modify the amount parameter before forwarding it to the payment gateway. Since the backend does not recalculate or verify this value against the product's actual price setting, the transaction proceeds with the manipulated figure, leading to financial loss for the merchant.
The operational impact of this vulnerability is severe from a business continuity and revenue integrity standpoint. Merchants relying on fixed-price models expect consistent revenue per unit sold; however, this flaw allows unauthorized users to acquire goods or services at drastically reduced prices without needing valid authentication credentials. This not only results in direct financial losses but also undermines the integrity of the e-commerce platform's pricing structure. Furthermore, such exploitation can be automated by threat actors to drain merchant accounts through high-volume low-cost purchases, potentially triggering fraud detection systems incorrectly if the pattern is detected too late. The lack of authentication requirement means that any internet user with basic knowledge of web request manipulation can exploit this flaw, widening the attack surface significantly compared to vulnerabilities requiring privileged access or valid session tokens.
To mitigate this vulnerability and prevent similar issues in future development cycles, immediate action must be taken by updating the Better Payment plugin to version 2.3.4 or later where these validation checks have been implemented. For organizations unable to update immediately due to compatibility constraints, a temporary workaround involves implementing custom server-side logic via hooks available in WordPress plugins to enforce price verification before passing data to the payment gateway. Developers should ensure that all financial calculations are performed on the server side using trusted data sources rather than relying on client-supplied values. Additionally, integrating robust input validation frameworks and adhering to OWASP guidelines for secure coding practices will help prevent such logic flaws. Regular security audits focusing on business logic vulnerabilities are recommended to identify similar weaknesses in other parts of the application stack that may not be covered by standard vulnerability scanners which often miss these types of logical errors.