This vulnerability (CVE-2026-42655) in WPManageNinja's Best Payments Plugin for WordPress (versions <= 4.6.19) is classified as CWE-472, indicating external control of an assumed-immutable web parameter. The issue allows unauthenticated attackers to bypass intended restrictions by manipulating web parameters that the plugin assumes remain constant, leading to a high impact on integrity. The CVSS 3.1 score is 7.5, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

The vulnerability allows unauthenticated attackers to bypass security controls by manipulating web parameters that the plugin assumes are immutable, resulting in a high integrity impact. This could enable unauthorized modification of data or actions within the plugin's functionality. There is no impact on confidentiality or availability reported. The attack requires high complexity and no privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor WPManageNinja communications for updates. No specific mitigations are provided by the vendor at this time.