CVE-2026-77765: CWE-284 Improper Access Control in Better Payment
The Better Payment WordPress plugin before 2.3.4 does not validate the submitted payment amount server-side against the merchant's configured fixed price before building the gateway charge, allowing unauthenticated users to pay an arbitrary reduced amount for a fixed-price item.
AI Analysis
Technical Summary
CVE-2026-77765 is an improper access control vulnerability (CWE-284) in the Better Payment WordPress plugin prior to version 2.3.4. The plugin fails to validate the submitted payment amount on the server side against the merchant's configured fixed price before processing the payment gateway charge. This allows unauthenticated attackers to manipulate payment amounts and pay less than the intended fixed price for items.
Potential Impact
An attacker can exploit this vulnerability to pay arbitrary reduced amounts for fixed-price items without authentication, potentially causing financial loss to merchants using the affected plugin versions.
Mitigation Recommendations
Upgrade the Better Payment plugin to version 2.3.4 or later, where this vulnerability is fixed. No other mitigation guidance is provided. Patch status is confirmed by the version range indicating fixed in 2.3.4.
CVE-2026-77765: CWE-284 Improper Access Control in Better Payment
Description
The Better Payment WordPress plugin before 2.3.4 does not validate the submitted payment amount server-side against the merchant's configured fixed price before building the gateway charge, allowing unauthenticated users to pay an arbitrary reduced amount for a fixed-price item.
CVSS v3.1
Score 5.3medium
Affected software
Better Payment
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-77765 is an improper access control vulnerability (CWE-284) in the Better Payment WordPress plugin prior to version 2.3.4. The plugin fails to validate the submitted payment amount on the server side against the merchant's configured fixed price before processing the payment gateway charge. This allows unauthenticated attackers to manipulate payment amounts and pay less than the intended fixed price for items.
Potential Impact
An attacker can exploit this vulnerability to pay arbitrary reduced amounts for fixed-price items without authentication, potentially causing financial loss to merchants using the affected plugin versions.
Mitigation Recommendations
Upgrade the Better Payment plugin to version 2.3.4 or later, where this vulnerability is fixed. No other mitigation guidance is provided. Patch status is confirmed by the version range indicating fixed in 2.3.4.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-08-21T10:44:32.094Z
- State
- PUBLISHED
Threat ID: 6ab36d3df7a7c541065abc92
Added to database: 09/23/2026, 06:10:05 UTC
Last enriched: 09/23/2026, 06:33:39 UTC
Last updated: 09/24/2026, 03:09:04 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.