CVE-2026-90987: Unknown Easy PayPal & Stripe Buy Now Button

Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field, so an unauthenticated attacker sets an arbitrary lower price for a purchase.

Affected products

• Unknown Easy PayPal & Stripe Buy Now Button: from 1.8, before 2.0.6 (fixed in 2.0.6)

Published 2026-10-02. Last modified 2026-10-02.