CVE-2026-42655: WordPress Best Payments Plugin for WP plugin <= 4.6.19 - Payment Bypass vulnerability

Synopsis

An authentication bypass vulnerability affects the Best Payments Plugin for WP by WPManageNinja at version 4.6.19 and earlier. The flaw is reachable over the network with no authentication required, though exploiting it reliably requires meeting certain environmental conditions derived from the high attack complexity rating. Successful exploitation allows an attacker to bypass payment verification, enabling fraudulent order completion or payment avoidance without tampering with underlying data or crashing the service. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress installation over the network; there is no requirement for local or physical access.

• AuthenticationNot required

  No account or session credential is needed; the bypass can be attempted by an anonymous, unauthenticated request.

• Victim interactionNot required

  The attacker does not need to involve or deceive any user or administrator to trigger the vulnerability.

• Attack complexityDetail

  Attack complexity is rated High, meaning the attacker must engineer specific conditions, such as precise request sequencing or a particular checkout state, for the bypass to succeed reliably.

Blast Radius

• An attacker can complete purchase flows without a valid payment, causing the merchant to fulfill orders for which no payment was collected.
• Payment integrity records are corrupted, as orders are marked paid in the system without a corresponding financial transaction.
• No confidential data is exposed and no service disruption is caused; the impact is confined to integrity of the payment pipeline.