Unauthenticated Bypass Vulnerability in Best Payments Plugin for WordPress
CVE-2026-42655

7.5HIGH

Key Information:

Vendor

WordPress
Status
Best Payments Plugin For WP
Vendor
CVE Published:
15 June 2026

What is CVE-2026-42655?

The Best Payments Plugin for WordPress has a security flaw in versions up to 4.6.19 that allows unauthenticated users to bypass several security measures. This vulnerability enables potential attackers to perform unauthorized actions within the payment system, potentially compromising sensitive user data and financial transactions. It's crucial for website owners to update to the latest version to mitigate risks and maintain secure payment processing.

Affected Version(s)

Best Payments Plugin for WP <= 4.6.19

References

https://patchstack.com/database/wordpress/plugin/wp-payme...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Weerawat Pawanawiwat (ErbaZZ) | Patchstack Bug Bounty Program
.