# Better Payment <= 2.4.2 - Authenticated (Contributor+) Sensitive Information Exposure of Payment Gateway Secret Keys via Elementor Widget

- **ID:** WPSEC-2026-1663
- **Plugin:** Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More (`better-payment`), https://wordpress.org/plugins/better-payment/
- **Affected versions:** all versions before 2.4.3
- **Fixed in:** 2.4.3 (Update to 2.4.3 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-26)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/better-payment
- **Fix released:** 2026-10-25
- **Published:** 2026-10-26
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1663/

## Description

The Better Payment plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.2. The Better Payment Elementor widget used the site's global Stripe (test and live) and Paystack secret keys as the default values of its secret key controls, and Elementor sends these defaults to anyone who can open the editor. This makes it possible for authenticated attackers with Contributor-level access and above to read the site's payment gateway secret keys and use them against the merchant's Stripe or Paystack account.

## References

- https://wpsec.com/vuln/WPSEC-2026-1663/
- https://plugins.svn.wordpress.org/better-payment/tags/2.4.3/
- https://wordpress.org/plugins/better-payment/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1663/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.