Executive brief
The Better Payment WordPress plugin allows customers to pay less than the required price for fixed-price items by manipulating the payment amount sent to the payment gateway. An attacker does not need to be logged in to exploit this, potentially allowing them to purchase items at arbitrary reduced prices, directly impacting merchant revenue.
Technical details
The plugin fails to validate the submitted payment amount server-side before constructing the gateway charge request, trusting client-supplied data. An unauthenticated attacker can intercept or manipulate the payment amount parameter to charge a lower amount than configured. This is a broken access control vulnerability (CWE-284) that affects versions before 2.3.4.
Affected products
- Better Payment before 2.3.4
Timeline
- 2026-09-21: disclosed
- 2026: patched: version 2.3.4 fixes the vulnerability