CVE-2026-57364: Better Payment WordPress Auth Bypass Flaw

CVE-2026-57364 Overview

CVE-2026-57364 is a broken access control vulnerability in the WPDeveloper Better Payment WordPress plugin. The flaw stems from improper validation of specified quantity in input [CWE-1284], allowing unauthenticated attackers to access functionality that should be restricted by access control lists (ACLs). The vulnerability affects Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More versions up to and including 2.2.0. Because the plugin handles payment, donation, and subscription workflows, exploitation can affect the integrity and availability of financial transactions processed through affected WordPress sites.

Critical Impact
Unauthenticated attackers can reach payment-related functionality over the network without user interaction, potentially manipulating transaction quantities or bypassing intended access restrictions.

Affected Products

WPDeveloper Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More plugin for WordPress
All versions from initial release through 2.2.0
WordPress installations running the vulnerable better-payment plugin

Discovery Timeline

2026-07-13 - CVE-2026-57364 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-57364

Vulnerability Analysis

The Better Payment plugin exposes functionality that is not properly constrained by access control lists. An unauthenticated remote attacker can invoke plugin endpoints across the network without prior credentials or user interaction. The weakness is classified under [CWE-1284] Improper Validation of Specified Quantity in Input, which indicates the plugin fails to validate that a supplied quantity value falls within an acceptable range or context before acting on it.

The EPSS probability for this CVE is 0.255% with a percentile of 17.058, indicating low near-term exploitation likelihood at the time of scoring. However, WordPress plugin vulnerabilities frequently see opportunistic scanning once public disclosure occurs through Patchstack.

Root Cause

The root cause is missing or insufficient authorization enforcement on plugin routes combined with inadequate validation of quantity fields submitted by clients. The plugin trusts client-supplied quantity input and does not verify that the caller is authorized to perform the requested action against the payment or subscription resource.

Attack Vector

An attacker crafts HTTP requests targeting exposed plugin endpoints on a WordPress site running Better Payment <= 2.2.0. Because the attack requires no privileges and no user interaction, exploitation can be automated at scale against internet-facing WordPress instances. The confidentiality impact is none, while integrity and availability impacts are both low, consistent with manipulation of quantity-bound business logic rather than full site compromise.

No verified public exploit code or proof-of-concept is currently available. Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-57364

Indicators of Compromise

Unauthenticated HTTP POST or GET requests to better-payment plugin endpoints under /wp-admin/admin-ajax.php or REST routes
Unexpected changes to payment quantities, donation totals, or subscription records without a corresponding authenticated administrator session
Web server access logs showing repeated automated requests referencing better-payment action parameters

Detection Strategies

Inspect WordPress request logs for calls to plugin AJAX actions or REST endpoints originating from anonymous sessions
Correlate transaction anomalies in the payment database with corresponding HTTP requests to plugin endpoints
Deploy WordPress security plugins or a WAF ruleset that flags requests targeting the vulnerable plugin version

Monitoring Recommendations

Enable verbose logging on the better-payment plugin and forward WordPress logs to a centralized SIEM
Alert on any modification of transaction records outside authenticated administrator workflows
Monitor plugin version inventory across managed WordPress sites to identify hosts still running versions <= 2.2.0

How to Mitigate CVE-2026-57364

Immediate Actions Required

Update the Better Payment plugin to a version later than 2.2.0 once WPDeveloper releases a patched build
Audit recent payment, donation, and subscription records for anomalous quantity values or unauthorized transactions
Restrict administrative and plugin endpoints via network controls or authentication proxies where feasible

Patch Information

At the time of publication, the vulnerability affects all versions through 2.2.0. Administrators should consult the Patchstack Vulnerability Report and the WPDeveloper plugin changelog for the fixed release version.

Workarounds

Deactivate and remove the Better Payment plugin until a patched version is installed and verified
Deploy web application firewall (WAF) rules that block unauthenticated requests to better-payment action handlers
Enforce server-side validation of transaction quantities at the payment gateway or reconciliation layer to detect tampered values

bash

# Example WAF rule pattern to block unauthenticated access to the vulnerable plugin endpoints
# ModSecurity example - adapt to your WAF syntax
SecRule REQUEST_URI "@rx /wp-admin/admin-ajax\.php" \
  "chain,phase:2,deny,status:403,id:1002026573,\
   msg:'Block unauthenticated Better Payment plugin access CVE-2026-57364'"
  SecRule ARGS:action "@rx better_payment" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"