{
 "id": "WPSEC-2026-1663",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1663/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1663/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1663/index.md",
 "title": "Better Payment <= 2.4.2 - Authenticated (Contributor+) Sensitive Information Exposure of Payment Gateway Secret Keys via Elementor Widget",
 "description": "The Better Payment plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.2. The Better Payment Elementor widget used the site's global Stripe (test and live) and Paystack secret keys as the default values of its secret key controls, and Elementor sends these defaults to anyone who can open the editor. This makes it possible for authenticated attackers with Contributor-level access and above to read the site's payment gateway secret keys and use them against the merchant's Stripe or Paystack account.",
 "plugin": {
  "slug": "better-payment",
  "name": "Better Payment",
  "full_name": "Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More",
  "wordpress_org": "https://wordpress.org/plugins/better-payment/",
  "advisories_url": "https://wpsec.com/vuln/plugin/better-payment/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/better-payment"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.4.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.4.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.4.3",
 "remediation": "Update to 2.4.3 or later.",
 "fix_released": "2026-10-25T10:25:49+00:00",
 "published": "2026-10-26T10:46:45+00:00",
 "updated": "2026-10-26T09:45:50.629458+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1663/",
  "https://plugins.svn.wordpress.org/better-payment/tags/2.4.3/",
  "https://wordpress.org/plugins/better-payment/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/better-payment",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-26"
 }
}