What is the CVSS score of CVE-2026-57364?

CVE-2026-57364 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.4%.

Better Payment CVE-2026-57364

EUVD-2026-43451 MEDIUM

Improper Validation of Specified Quantity in Input (CWE-1284)

2026-07-13 Patchstack

WordPress Information Disclosure Wordpress Plugin Better Payment Instant Payments Donations Fundraising With Subscriptions Amp More Wpdeveloper

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

7.3 HIGH

AV:N/PR:N confirmed by publicly accessible payment forms; C:L elevated from C:N to reflect Patchstack's Information Disclosure tag, which conflicts with the NVD C:N rating.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:29 vuln.today

DescriptionCVE.org

Improper Validation of Specified Quantity in Input vulnerability in WPDeveloper Better Payment - Instant Payments, Donations, Fundraising with Subscriptions & More better-payment allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Better Payment - Instant Payments, Donations, Fundraising with Subscriptions & More: from n/a through <= 2.2.0.

AnalysisAI

Unauthenticated remote exploitation of the Better Payment WordPress plugin (versions through 2.2.0) allows attackers to bypass access control restrictions by submitting improperly validated quantity inputs, enabling unauthorized access to functionality protected by ACLs. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the plugin's payment and subscription handling endpoints are reachable without credentials, producing both integrity and availability impact. No active exploitation confirmed; no public exploit identified at time of analysis.

Technical ContextAI

CWE-1284 (Improper Validation of Specified Quantity in Input) describes a failure to validate that numeric or quantity-type values fall within an expected, authorized range before acting on them. In a payment and donation plugin context, this means an attacker can submit out-of-bounds or manipulated quantity values to reach code paths - such as subscription tiers, donation thresholds, or payment amount handlers - that are intended to be gated by role or capability checks. The ACL bypass consequence indicates that WordPress capability or nonce checks protecting restricted endpoints are circumvented when the input quantity is malformed. The CPE (cpe:2.3:a:wpdeveloper:better_payment_-_instant_payments,_donations,_fundraising_with_subscriptions_&_more:*:*:*:*:*:*:*:*) identifies the WPDeveloper Better Payment plugin as the sole affected product. Patchstack reported the issue, and the 'Information Disclosure' tag alongside the ACL bypass CWE suggests restricted data may be exposed beyond the primary integrity/availability CVSS impacts.

RemediationAI

Update the Better Payment plugin to a version beyond 2.2.0 as soon as a patched release is made available by WPDeveloper. No exact patched version number is confirmed in the available intelligence - check the WordPress plugin repository and the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/better-payment/vulnerability/wordpress-better-payment-instant-payments-donations-fundraising-with-subscriptions-more-plugin-2-2-0-other-vulnerability-type-vulnerability?_s_id=cve for the latest update. If immediate patching is not possible, restrict access to the plugin's AJAX or REST endpoints at the web server or WAF level to authenticated sessions only; this trades off unauthenticated donation form functionality for a reduced attack surface. As a further compensating control, use a WAF rule to block requests with anomalous quantity parameter values (e.g., negative numbers, zero, or values exceeding business thresholds) targeting the plugin's endpoints, noting this requires tuning per site configuration. Disable the subscription feature within the plugin's settings if subscriptions are not actively in use, removing an access surface area until a patch is available.