MEDIUM 5.3 NVD

CVE-2026-89411

The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe payment belongs to the order it is applied to, allowing unauthe

The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe payment belongs to the order it is applied to, allowing unauthenticated users to mark an arbitrary pending order as paid by confirming a smaller payment of their own against it.

References

https://wpscan.com/vulnerability/240a0440-7892-4c03-b282-2fdb6f086bb6/

Published: 2026-09-28 · Source: NVD · Feed updated: 2026-09-28

This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-09-28 via NVD.

vulnfeed aggregates 13625 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.