CVE-2026-42655— WordPress Best Payments Plugin for WP plugin <= 4.6.19 - Payment Bypass vulnerability
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| WPManageNinja | Best Payments Plugin for WP | n/a≤ 4.6.19 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-42655
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress Best Payments Plugin for WP plugin <= 4.6.19 - Payment Bypass vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Unauthenticated Bypass Vulnerability in Best Payments Plugin for WP <= 4.6.19 versions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对假设不可变Web参数的外部可控制
Source: CVE Program / CVE List V5
Vulnerability Title
WPManageNinja Best Payments Plugin for WP 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Best Payments Plugin for WP是WPManageNinja公司的一款WordPress支付插件 WPManageNinja Best Payments Plugin for WP 4.6.19及之前版本存在输入验证错误漏洞，该漏洞源于输入验证错误，可能导致未经验证的绕过攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| WPManageNinja | Best Payments Plugin for WP | n/a ~ 4.6.19 | - |
II. Public POCs for CVE-2026-42655
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-42655
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-42655 (1)
IV. Related Vulnerabilities
Same vendor: WPManageNinja
- CVE-2026-66633
WordPress Fluent Forms Pro Add On Pack plugin < 6.2.12 - Cro - CVE-2026-73532
Fluent Forms Pro 6.2.7 Embedded Malicious Code via Tampered - CVE-2026-73533
Ninja Tables Pro 5.2.11 Embedded Malicious Code via Tampered - CVE-2026-66467
WordPress FluentCommunity plugin <= 2.7.5 - Cross Site Scrip - CVE-2026-18146
Fluent Forms <= 6.2.11 - Unauthenticated Stored Cross-Site S
Same weakness: CWE-472
- CVE-2026-67363
Joomla Extension - balbooa.com - Pre-auth Payment Amount Tam - CVE-2026-1982
Persian Elementor (المنتور فارسی) <= 2.8.1 - Unauthenticated - CVE-2026-7484
Improper Access Control in Abis Technology's AVESİS - CVE-2026-65052
Ninja Forms Calculation and Payment Total Tampering via Fail - CVE-2026-56877
Skillable SCORM Lab Launch Integration 输入验证错误漏洞
V. Comments for CVE-2026-42655
No comments yet