Vulnerabilities / Better Payment / WPSEC-2026-1662
Better Payment <= 2.4.2 - Unauthenticated CSV Injection via Payment Form Fields
Medium 5.4
CWE-1236Fixed in 2.4.3
- ID
- WPSEC-2026-1662
- Plugin
- Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More (better-payment)
- Affected
- all versions before 2.4.3
- Remediation
- Update to 2.4.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
- Weakness
- CWE-1236
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-26
- Attack surface
- Better Payment on WPSec AttackSurface
- Fix released
- Published
Description
The Better Payment plugin for WordPress is vulnerable to CSV Injection via payment form fields such as the payer's first and last name in all versions up to, and including, 2.4.2, due to the transaction export writing donor-supplied values to the CSV file without neutralizing cells that begin with formula characters. This makes it possible for unauthenticated attackers to embed spreadsheet formulas in a transaction. The formulas can run on the administrator's computer when an administrator exports transactions and opens the file in a spreadsheet application.
References
- https://wpsec.com/vuln/WPSEC-2026-1662/
- https://plugins.svn.wordpress.org/better-payment/tags/2.4.3/
- https://wordpress.org/plugins/better-payment/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS