CVE-2026-77765 Overview
CVE-2026-77765 affects the Better Payment WordPress plugin in versions prior to 2.3.4. The plugin fails to validate submitted payment amounts server-side against the merchant's configured fixed price before constructing the gateway charge. Unauthenticated attackers can submit an arbitrary reduced amount and complete checkout for a fixed-price item at that lower value. The flaw is a broken access control issue tracked as [CWE-284]. It carries a network attack vector with no privileges or user interaction required. The vulnerability maps to a business logic and input validation weakness rather than a memory or code execution class defect.
Critical Impact
Unauthenticated attackers can pay an arbitrary reduced amount for fixed-price items, causing direct revenue loss to affected merchants.
Affected Products
- Better Payment WordPress plugin versions before 2.3.4
- WordPress sites using Better Payment for fixed-price checkout
- Merchant storefronts relying on client-supplied amount fields
Discovery Timeline
- 2026-09-23 - CVE-2026-77765 published to the National Vulnerability Database (NVD)
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-77765
Vulnerability Analysis
The Better Payment plugin exposes a payment initiation flow that accepts an amount value from the client request. The plugin forwards this value into the gateway charge construction routine without cross-checking it against the merchant-configured fixed price stored server-side. Because the check is absent, the transaction proceeds using the attacker-controlled amount. The result is a business logic flaw that allows arbitrary underpayment for products or services priced as fixed items. No authentication is required, so any visitor able to reach the checkout endpoint can trigger the condition.
Root Cause
The root cause is missing server-side validation of the submitted payment amount against the trusted, stored price. The plugin treats the client-supplied value as authoritative during charge assembly. This is classified as improper access control [CWE-284] applied to a business logic boundary.
Attack Vector
Exploitation occurs over the network against the plugin's public checkout handler. An attacker intercepts or crafts the payment submission and modifies the amount field to a lower value before forwarding it to the payment gateway routine. Because the plugin does not reconcile that value with the configured fixed price, the gateway is charged the reduced amount and the order is recorded as paid. See the WPScan Vulnerability Report for technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-77765
Indicators of Compromise
- Completed orders with payment totals below the configured fixed price for a product
- Gateway charge records that do not match the storefront's listed price for the same SKU
- Repeated checkout requests from a single source with varying amount parameter values
Detection Strategies
- Reconcile the price field in every payment webhook against the server-side product price catalog
- Alert on any successful transaction where the charged amount is less than the stored product price
- Review web server logs for POST requests to Better Payment endpoints containing anomalous amount parameters
Monitoring Recommendations
- Monitor WordPress plugin version inventory and flag Better Payment installs older than 2.3.4
- Enable payment gateway alerts for unusually low-value transactions against fixed-price SKUs
- Track application logs for repeated failed or replayed checkout attempts from unauthenticated sessions
How to Mitigate CVE-2026-77765
Immediate Actions Required
- Update the Better Payment WordPress plugin to version 2.3.4 or later
- Audit recent orders for underpaid transactions against fixed-price items and issue refunds or chargebacks as needed
- Disable the plugin on any site that cannot be patched immediately
Patch Information
The vendor addressed the issue in Better Payment version 2.3.4 by enforcing server-side validation of the submitted payment amount against the merchant-configured fixed price. Administrators should upgrade through the WordPress plugin dashboard or by replacing the plugin files with the fixed release. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Deactivate the Better Payment plugin until the site can be upgraded to 2.3.4
- Add a web application firewall rule that inspects checkout POST requests and rejects submissions where the amount deviates from the configured product price
- Enable manual review for all new orders processed through Better Payment until the patch is applied
# Configuration example
# Upgrade Better Payment plugin via WP-CLI
wp plugin update better-payment --version=2.3.4
wp plugin get better-payment --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
