medium5.3
CVE-2026-89411
The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe payment belongs to the order it is applied to, allowing unauth…
Impact
The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe payment belongs to the order it is applied to, allowing unauthenticated users to mark an arbitrary pending order as paid by confirming a smaller payment of their own against it.
Affected products
| Product | Affected versions |
|---|---|
| Paymattic WordPress Plugin From 4.6.20 | before 4.6.26 |
Versions were read from the advisory text. No structured product data has been published for this record yet.