EUVD-2026-36820
GHSA-g7qv-r436-2gvc
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Network-reachable unauthenticated flaw with AC:H for required parameter manipulation knowledge; I:H for payment bypass; C and A remain N as only financial integrity is impacted.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
3DescriptionCVE.org
Unauthenticated Bypass Vulnerability in Best Payments Plugin for WP <= 4.6.19 versions.
AnalysisAI
Payment bypass in Best Payments Plugin for WP (versions ≤ 4.6.19) allows unauthenticated remote attackers to circumvent payment verification by manipulating HTTP parameters the plugin incorrectly treats as immutable, enabling completion of purchases without actual payment. Rooted in CWE-472 (External Control of Assumed-Immutable Web Parameter), the flaw directly threatens the financial integrity of any WordPress e-commerce site relying on this plugin for order processing. No public exploit is identified and CVSS AC:H indicates exploitation requires deliberate parameter manipulation during an active payment flow, limiting mass-exploitation risk despite the unauthenticated attack vector.
Technical ContextAI
CWE-472 (External Control of Assumed-Immutable Web Parameter) describes a class of flaw where an application transmits state data to the client - such as hidden form fields, cookies, or query parameters encoding payment status, order amount, or verification tokens - and later trusts that data as authoritative when it is returned without cryptographic validation or server-side re-verification. The Best Payments Plugin for WP by wpmanageninja (CPE: cpe:2.3:a:wpmanageninja:best_payments_plugin_for_wp:*:*:*:*:*:*:*:*) processes payments in WordPress environments and, based on the CWE and CVSS vector, appears to pass payment-state parameters client-side without signing or binding them to a server-authoritative record. When these parameters are submitted back by the client, the plugin accepts them at face value, treating a client-supplied 'payment successful' signal as legitimate. The CVSS AC:H metric confirms that successful exploitation requires understanding the plugin's specific parameter structure and the sequence of the payment flow, distinguishing this from a trivially automatable flaw.
RemediationAI
No vendor-released patch version is independently confirmed from available data; administrators should immediately consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-payment-form/vulnerability/wordpress-best-payments-plugin-for-wp-plugin-4-6-19-payment-bypass-vulnerability?_s_id=cve for the latest fix status and upgrade instructions. If a patched version has been released in the WordPress plugin repository, updating to it is the primary remediation. As a compensating control where patching is not immediately possible, temporarily deactivating the plugin eliminates exposure entirely but halts payment processing. Restricting checkout page access to authenticated users only, if the plugin supports such configuration, raises the exploitation bar from PR:N to at least PR:L. Deploying a WAF rule to flag or block anomalous parameter values in payment-related POST requests (e.g., unexpected payment status values not originating from the payment gateway callback endpoint) provides partial mitigation with minimal trade-offs. Server-side re-validation of all payment-state data against authoritative payment gateway records - rather than client-submitted fields - should be treated as a permanent architectural requirement for any replacement or updated plugin version.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today