paymendo WordPress Plugin CVE-2026-89305

Requires an authenticated session with at least a low-privilege account on the target WordPress site (CVSS PR:L); exploitation targets the paymendo plugin (version ≤1.1) where a specific request parameter is passed into a SQL query without proper sanitization/escaping. The exact parameter and endpoint are not named in the available description - confirm against the WPScan advisory. The key limiting factor is the authentication requirement: on sites that disable open user registration, the attacker must first obtain valid credentials, whereas sites allowing self-service subscriber registration effectively reduce this to any attacker. No user interaction is required, and the attack is network-reachable against affected installations.

This is a moderate-risk, authenticated SQL injection (CWE-89) in the paymendo WordPress plugin. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5 Medium) indicates network-reachable, low-complexity exploitation that requires some authentication (PR:L) and no user interaction, with high confidentiality impact but no modeled integrity or availability impact. Publicly available exploit code exists (reported by WPScan), which raises practical risk, but there is NO CISA KEV listing and no EPSS score was supplied in the input, so there is no evidence of active or widespread exploitation - POC availability and active exploitation are distinct signals and should not be conflated. The requirement for an authenticated account (PR:L) meaningfully limits the attacker population; however, on WordPress sites that permit open/subscriber-level registration, even the lowest-privileged account can meet this bar, which would effectively lower the barrier. The C:H/I:N/A:N impact profile is plausible for a read-oriented injection but is conservative - real-world SQL injection frequently enables data modification or authentication bypass, so the true integrity/availability impact may be understated; verify the injectable sink against the vendor/WPScan advisory. Net assessment: a real but not emergency priority - patch promptly, prioritizing sites with open registration, but this is not a high-urgency internet-wide threat.

An attacker registers or obtains any authenticated account on a WordPress site running paymendo ≤1.1, then sends a crafted request with a malicious value in the unsanitized parameter, injecting SQL into the backend query to exfiltrate sensitive database contents such as user credentials or payment-related data. Because low-complexity public exploit code exists (WPScan), weaponization requires little skill; the main constraint is obtaining the required low-privilege account.