# Better Payment <= 2.4.2 - Unauthenticated CSV Injection via Payment Form Fields

- **ID:** WPSEC-2026-1662
- **Plugin:** Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More (`better-payment`), https://wordpress.org/plugins/better-payment/
- **Affected versions:** all versions before 2.4.3
- **Fixed in:** 2.4.3 (Update to 2.4.3 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-1236
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-26)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/better-payment
- **Fix released:** 2026-10-25
- **Published:** 2026-10-26
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1662/

## Description

The Better Payment plugin for WordPress is vulnerable to CSV Injection via payment form fields such as the payer's first and last name in all versions up to, and including, 2.4.2, due to the transaction export writing donor-supplied values to the CSV file without neutralizing cells that begin with formula characters. This makes it possible for unauthenticated attackers to embed spreadsheet formulas in a transaction. The formulas can run on the administrator's computer when an administrator exports transactions and opens the file in a spreadsheet application.

## References

- https://wpsec.com/vuln/WPSEC-2026-1662/
- https://plugins.svn.wordpress.org/better-payment/tags/2.4.3/
- https://wordpress.org/plugins/better-payment/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1662/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.