Description

The Better Payment WordPress plugin before 2.3.4 does not validate the submitted payment amount server-side against the merchant's configured fixed price before building the gateway charge, allowing unauthenticated users to pay an arbitrary reduced amount for a fixed-price item.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-23T06:17:01.827Z",
  "pubdate": "2026-09-23T06:17:01.827Z",
  "executiveSummary": "The Better Payment WordPress plugin, in versions prior to 2.3.4, is susceptible to an Improper Input Validation vulnerability.\nThis security flaw allows an unauthenticated attacker to manipulate the transaction amount during the checkout process.\nThe vulnerability exists because the plugin fails to perform server-side validation of the payment amount against the merchant-configured price before initiating a charge with the payment gateway.\nSuccessful exploitation enables remote, unauthenticated actors to pay an arbitrary, significantly reduced amount for fixed-price items, directly impacting the financial integrity of the merchant's transactions.\nThis represents a significant business logic vulnerability that bypasses standard e-commerce security controls, necessitating an immediate update to version 2.3.4 or higher to enforce server-side price verification.\nThe risk is critical as it requires no user interaction or elevated privileges, allowing for automated exploitation by malicious entities.",
  "technicalDetails": "The vulnerability originates from a deficiency in the transaction processing logic within the Better Payment plugin, specifically concerning how it handles payment requests sent to external payment gateways.\nThe root cause is the reliance on client-side data for the determination of the final transaction amount. When a user initiates a purchase, the plugin constructs the payment charge based on the parameters submitted in the request, such as POST or GET variables, without re-validating these values against the authoritative pricing data stored on the server.\nThe attack flow begins when an unauthenticated user navigates to the payment checkout page. Before the final submission to the gateway, the attacker intercepts or modifies the HTTP request parameters that dictate the transaction amount. Because the backend code trusts the user-supplied amount parameter rather than recalculating or verifying it against the configured fixed price of the item, the plugin passes the manipulated, lower amount to the payment gateway.\nThe payment gateway, lacking context of the original item cost, processes the transaction based on the provided, incorrect amount. Consequently, the merchant receives a fraction of the intended payment while the system confirms the order as paid, leading to a financial loss for the merchant and potential inventory or service abuse.\nAffected versions include all iterations of the Better Payment plugin prior to 2.3.4. The vulnerability is exploitable remotely over the network without the need for authentication or specialized privileges, as the checkout process is inherently public-facing.\nPost-exploitation impact includes unauthorized price manipulation, direct financial loss to the merchant, and potential bypass of access controls for digital goods or services. The lack of server-side integrity checks essentially allows any malicious user to define their own price point for products regardless of the merchant's intended configuration."
}