diff --git a/app/controllers/spree/admin/payment_methods_controller.rb b/app/controllers/spree/admin/payment_methods_controller.rb
index 4665417bcf..a1303eed0f 100644
--- a/app/controllers/spree/admin/payment_methods_controller.rb
+++ b/app/controllers/spree/admin/payment_methods_controller.rb
@@ -15,7 +15,7 @@ module Spree
         @payment_method = params[:payment_method].
           delete(:type).
           constantize.
-          new(params[:payment_method])
+          new(payment_method_params)
         @object = @payment_method
 
         invoke_callbacks(:create, :before)
@@ -40,8 +40,8 @@ module Spree
           @payment_method = PaymentMethod.find(params[:id])
         end
 
-        payment_method_params = params[ActiveModel::Naming.param_key(@payment_method)] || {}
-        attributes = params[:payment_method].merge(payment_method_params)
+        update_params = params[ActiveModel::Naming.param_key(@payment_method)] || {}
+        attributes = payment_method_params.merge(update_params)
         attributes.each do |k, _v|
           if k.include?("password") && attributes[k].blank?
             attributes.delete(k)
@@ -100,6 +100,10 @@ module Spree
 
       private
 
+      def payment_method_params
+        params.require(:payment_method).permit!
+      end
+
       def force_environment
         params[:payment_method][:environment] = Rails.env unless spree_current_user.admin?
       end