CVE-2026-77765 — Better Payment < 2.3.4 - Unauthenticated Payment Amount Manipulation
The Better Payment WordPress plugin before 2.3.4 does not validate the submitted payment amount server-side against the merchant's configured fixed price before building the ga…
Published: 2026-09-23 · CVSS: 5.3 · CVSS 3.1
The Better Payment WordPress plugin before 2.3.4 does not validate the submitted payment amount server-side against the merchant's configured fixed price before building the gateway charge, allowing unauthenticated users to pay an arbitrary reduced amount for a fixed-price item.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7