🚨 CVE-2026-89411
The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe payment belongs to the order it is applied to, allowing unauthenticated users to mark an arbitrary pending order as paid by confirming a smaller payment of their own against it.
🎖@cveNotify
WPScan
Paymattic < 4.6.26 - Unauthenticated Payment Bypass via Unbound Stripe PaymentIntent
See details on Paymattic < 4.6.26 - Unauthenticated Payment Bypass via Unbound Stripe PaymentIntent CVE 2026-89411. View the latest Plugin Vulnerabilities on WPScan.
September 28, 2026 45
