CVE-2026-89411

Paymattic < 4.6.26 - Unauthenticated Payment Bypass via Unbound Stripe PaymentIntent

The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe payment belongs to the order it is applied to, allowing unauthenticated users to mark an arbitrary pending order as paid by confirming a smaller payment of their own against it.

Affected

Paymattic

CVSS v3.1 WPSCAN

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.11% chance of exploitation in the next 30 days, 1st percentile

Published

2026-09-28

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/240a0440-7892-4c03-b282-2fdb6f086bb6/

References

• CVE Record
• NVD entry