Best Payments Plugin CVE-2026-42655

The target WordPress site must have Best Payments Plugin for WP version 4.6.19 or earlier installed and active with at least one publicly accessible payment form or checkout flow. CVSS PR:N confirms exploitation requires no authentication - anonymous visitors who can reach the checkout page are potential attackers. CVSS AC:H limits exploitation to individuals with the technical ability to intercept and modify HTTP requests during an active payment session (requiring a tool such as Burp Suite or a browser developer console) and sufficient knowledge of the plugin's parameter naming and expected values. Exploitation is further constrained by the need to actively engage a payment flow rather than passively scanning endpoints. No non-default WordPress configuration is required beyond having the plugin installed and operational; any site running a vulnerable version with an active storefront is at risk during checkout sessions. The limiting factors for defenders to note are: AC:H eliminates script-kiddie mass exploitation; no public exploit reduces immediate threat surface; and C:N/A:N means the flaw cannot be leveraged for data exfiltration or service disruption.

The CVSS 3.1 score is 5.9 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N. The network attack vector and absence of privilege requirements (PR:N, confirmed by CVSS) lower the bar for any attacker who can reach the checkout flow, but high attack complexity (AC:H) requires deliberate HTTP parameter manipulation and knowledge of the plugin's payment flow - ruling out trivial automated scanning. Integrity impact is high (I:H), meaning successful exploitation allows free acquisition of goods or services on affected stores; confidentiality and availability are entirely unaffected (C:N/A:N). No EPSS data was provided, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV and no public exploit code has been identified, indicating no confirmed active exploitation at time of analysis. Given AC:H and the absence of public exploit tooling, SSVC automatable signal is low; however, motivated actors manually targeting specific high-value merchants represent a plausible threat. The business risk is meaningful for e-commerce operators but unlikely to manifest as mass-exploitation campaigns. No conflicting data signals are present in the available intelligence.

An attacker targeting a WordPress store initiates a legitimate checkout session, then uses an HTTP interception proxy (such as Burp Suite) to capture and modify the payment parameters submitted during the flow - for example, changing a payment status field or amount parameter to indicate a successful transaction before submitting the request. The vulnerable plugin accepts these client-supplied values without re-verifying against a server-side authoritative record or payment gateway callback, records the order as paid, and delivers goods or services without any funds being transferred. No public exploit code is identified at time of analysis, but the attack requires only standard HTTP interception skills and familiarity with the plugin's parameter structure.