The vulnerability CVE-2026-57364 in WPDeveloper's Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More plugin is caused by improper validation of the specified quantity in input. This flaw allows access to functionality that is not properly constrained by access control lists (ACLs), potentially enabling unauthorized actions. The issue affects all versions up to and including 2.2.0. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, but low integrity and low availability impacts. No vendor advisory or patch information is available at this time.

Exploitation of this vulnerability can lead to unauthorized access to certain plugin functionalities due to insufficient access control validation. This may result in limited integrity and availability impacts within the affected WordPress environment. There is no impact on confidentiality. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor vendor communications for updates. Avoid relying on this plugin in sensitive environments or restrict its usage where possible.