CVE WATCH / VULNERABILITY DETAIL
CVE-2026-89411
MEDIUMCVSS 5.3NVD feed
Published 28 September 2026 · tracked since 28 September 2026
Description
The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe payment belongs to the order it is applied to, allowing unauthenticated users to mark an arbitrary pending order as paid by confirming a smaller payment of their own against it.
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-126184 HIGH 8.2
- CVE-2026-126183 HIGH 8.7
- CVE-2026-126181 HIGH 8
- CVE-2026-126180 HIGH 8.4
- CVE-2026-126177 HIGH 8.1
- CVE-2026-126176 HIGH 8.1
- CVE-2026-126175 HIGH 8.8
- CVE-2026-126170 CRITICAL 9.8
- CVE-2026-126165 HIGH 7.5
- CVE-2026-126164 CRITICAL 9.4