Vulnerabilities / Better Payment / WPSEC-2026-1663
Better Payment <= 2.4.2 - Authenticated (Contributor+) Sensitive Information Exposure of Payment Gateway Secret Keys via Elementor Widget
Medium 6.5
CWE-200Fixed in 2.4.3
- ID
- WPSEC-2026-1663
- Plugin
- Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More (better-payment)
- Affected
- all versions before 2.4.3
- Remediation
- Update to 2.4.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-26
- Attack surface
- Better Payment on WPSec AttackSurface
- Fix released
- Published
Description
The Better Payment plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.2. The Better Payment Elementor widget used the site's global Stripe (test and live) and Paystack secret keys as the default values of its secret key controls, and Elementor sends these defaults to anyone who can open the editor. This makes it possible for authenticated attackers with Contributor-level access and above to read the site's payment gateway secret keys and use them against the merchant's Stripe or Paystack account.
References
- https://wpsec.com/vuln/WPSEC-2026-1663/
- https://plugins.svn.wordpress.org/better-payment/tags/2.4.3/
- https://wordpress.org/plugins/better-payment/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS