CVE-2026-77765: Better Payment WordPress Auth Bypass Flaw

CVE-2026-77765 Overview

CVE-2026-77765 affects the Better Payment WordPress plugin in versions prior to 2.3.4. The plugin fails to validate submitted payment amounts server-side against the merchant's configured fixed price before constructing the gateway charge. Unauthenticated attackers can submit an arbitrary reduced amount and complete checkout for a fixed-price item at that lower value. The flaw is a broken access control issue tracked as [CWE-284]. It carries a network attack vector with no privileges or user interaction required. The vulnerability maps to a business logic and input validation weakness rather than a memory or code execution class defect.

Critical Impact
Unauthenticated attackers can pay an arbitrary reduced amount for fixed-price items, causing direct revenue loss to affected merchants.

Affected Products

Better Payment WordPress plugin versions before 2.3.4
WordPress sites using Better Payment for fixed-price checkout
Merchant storefronts relying on client-supplied amount fields

Discovery Timeline

2026-09-23 - CVE-2026-77765 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-77765

Vulnerability Analysis

The Better Payment plugin exposes a payment initiation flow that accepts an amount value from the client request. The plugin forwards this value into the gateway charge construction routine without cross-checking it against the merchant-configured fixed price stored server-side. Because the check is absent, the transaction proceeds using the attacker-controlled amount. The result is a business logic flaw that allows arbitrary underpayment for products or services priced as fixed items. No authentication is required, so any visitor able to reach the checkout endpoint can trigger the condition.

Root Cause

The root cause is missing server-side validation of the submitted payment amount against the trusted, stored price. The plugin treats the client-supplied value as authoritative during charge assembly. This is classified as improper access control [CWE-284] applied to a business logic boundary.

Attack Vector

Exploitation occurs over the network against the plugin's public checkout handler. An attacker intercepts or crafts the payment submission and modifies the amount field to a lower value before forwarding it to the payment gateway routine. Because the plugin does not reconcile that value with the configured fixed price, the gateway is charged the reduced amount and the order is recorded as paid. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-77765

Indicators of Compromise

Completed orders with payment totals below the configured fixed price for a product
Gateway charge records that do not match the storefront's listed price for the same SKU
Repeated checkout requests from a single source with varying amount parameter values

Detection Strategies

Reconcile the price field in every payment webhook against the server-side product price catalog
Alert on any successful transaction where the charged amount is less than the stored product price
Review web server logs for POST requests to Better Payment endpoints containing anomalous amount parameters

Monitoring Recommendations

Monitor WordPress plugin version inventory and flag Better Payment installs older than 2.3.4
Enable payment gateway alerts for unusually low-value transactions against fixed-price SKUs
Track application logs for repeated failed or replayed checkout attempts from unauthenticated sessions

How to Mitigate CVE-2026-77765

Immediate Actions Required

Update the Better Payment WordPress plugin to version 2.3.4 or later
Audit recent orders for underpaid transactions against fixed-price items and issue refunds or chargebacks as needed
Disable the plugin on any site that cannot be patched immediately

Patch Information

The vendor addressed the issue in Better Payment version 2.3.4 by enforcing server-side validation of the submitted payment amount against the merchant-configured fixed price. Administrators should upgrade through the WordPress plugin dashboard or by replacing the plugin files with the fixed release. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Deactivate the Better Payment plugin until the site can be upgraded to 2.3.4
Add a web application firewall rule that inspects checkout POST requests and rejects submissions where the amount deviates from the configured product price
Enable manual review for all new orders processed through Better Payment until the patch is applied

bash

# Configuration example
# Upgrade Better Payment plugin via WP-CLI
wp plugin update better-payment --version=2.3.4
wp plugin get better-payment --field=version