Buy Now Button CVE-2026-90987

No special conditions beyond having the plugin active and a reachable checkout: remote unauthenticated exploitation (AV:N/PR:N/UI:N) against default configurations of the Easy PayPal & Stripe Buy Now Button plugin on versions before 2.0.6. The specific prerequisite is that the payment amount is taken from a client-supplied field and never recomputed server-side, so the attacker only needs to modify that field in the checkout request. Limiting factors: the target site must run this specific plugin at a vulnerable version, and impact is confined to transaction price manipulation (financial loss to the merchant) with no data exposure or service disruption; upgrading to 2.0.6 removes the condition.

This is a server-side validation / business-logic flaw (CWE class: improper validation of a client-supplied value) in which the purchase amount is trusted from the client instead of being recomputed on the server. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) is internally consistent with the description: network-reachable, low complexity, no authentication (PR:N) and no user interaction, with impact limited to Integrity-Low (an attacker tampers with the transacted price) and no confidentiality or availability impact. A public exploit exists (WPScan), but there is no CISA KEV listing and no EPSS score in the input, so there is no evidence of active or widespread exploitation. The 5.3/MEDIUM base score understates the practical business consequence - direct financial loss through underpayment for goods/services - because CVSS does not model monetary fraud well; conversely, the real-world footprint is small (a niche WordPress payment-button plugin), so this is a targeted merchant-fraud risk rather than a mass-exploitation priority. Net: genuine and easily abused where the plugin is installed, but low aggregate risk due to limited deployment. Note: CWE is listed as N/A and no EPSS/KEV data was supplied, so exploitation-probability signals are absent and cannot be compared.

An attacker browsing a shop that uses the plugin intercepts the checkout request (e.g., via browser dev tools or a proxy) and rewrites the client-supplied price field to an arbitrarily low value such as $0.01 before it reaches PayPal/Stripe. Because the server never recomputes the amount, the order is accepted at the attacker-chosen price. A public exploit is available via WPScan and the attack is remote, unauthenticated, and low-complexity (AV:N/AC:L/PR:N).