CVE-2026-89411
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Sep 28, 2026
Vendor
unknown
Description
The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe payment belongs to the order it is applied to, allowing unauthenticated users to mark an arbitrary pending order as paid by confirming a smaller payment of their own against it.