paymendo WordPress plugin CVE-2026-89304

The target must be a WordPress site with the paymendo plugin installed and active at version 1.1 or earlier; exploitation targets a specific plugin parameter that is not sanitized or escaped before use in a SQL query. Per the CVE description, no authentication is required (unauthenticated), and no user interaction is needed, so the practical limiting factors are simply that the vulnerable plugin is present and the specific endpoint/parameter is reachable. Note the input CVSS vector's PR:L contradicts the unauthenticated description - if authentication is in fact required, that would be the primary limiting condition and should be verified with the vendor/WPScan advisory.

This is a medium-severity (CVSS 6.5) blind SQL injection (CWE-89) in the 'paymendo' WordPress plugin through v1.1, reported by WPScan, with publicly available exploit code but no CISA KEV listing and no EPSS score provided in the input. A key conflict exists in the source data: the NVD/input CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, which encodes PR:L (requiring some authentication), yet the official description explicitly states 'unauthenticated users' can perform the attack - verify with the WPScan advisory, as unauthenticated status materially raises real-world risk. The impact profile is confidentiality-only (C:H/I:N/A:N), consistent with blind data exfiltration rather than code execution or site takeover. Exploitation status is 'publicly available exploit code exists' (POC via WPScan); this is NOT confirmed active exploitation and must not be conflated with in-the-wild use. Net assessment: the network vector, low complexity, and public POC make this a genuine priority for any site actually running paymendo, but the plugin's apparent obscurity and tiny footprint sharply limit mass-exploitation potential, suggesting this is a real but narrowly-scoped risk rather than a widespread emergency.

An attacker identifies a WordPress site running the paymendo plugin (≤1.1) and sends a crafted request injecting SQL into the unsanitized vulnerable parameter. Using boolean/time-based blind techniques, they infer and extract sensitive database contents such as user credentials or payment-related records one bit at a time. A public exploit/advisory from WPScan exists, lowering the skill barrier, and per the description no authentication is required.