Paymattic EUVD-2026-88101

Requires the target site to run Paymattic 4.6.20-4.6.25 with the Stripe payment gateway configured and at least one pending (unpaid) order available to hijack. The attacker must be able to create and confirm their own (smaller, real/chargeable) Stripe payment and direct that confirmation at the victim order, so exploitation carries a real payment cost and depends on Stripe being the active gateway. No authentication or user interaction is needed (PR:N/UI:N), and it is exploitable remotely over the network, but the Stripe-gateway-plus-pending-order preconditions meaningfully limit real-world applicability versus a truly unconditional default-config flaw.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) is internally consistent with the description: a remote, unauthenticated attacker (PR:N) can trigger the flaw over the network with low complexity and no user interaction, producing a low integrity impact (I:L) and no confidentiality or availability impact. This is a business-logic / payment-integrity flaw (CWE-345-style insufficient verification that a confirmed Stripe payment belongs to the order it is applied to), not information disclosure - so the 'Information Disclosure' tag is mislabeled. Real-world risk is moderate-but-targeted rather than mass-scannable: publicly available exploit code exists (WPScan), but there is no EPSS score, no CISA KEV listing, and no SSVC data supplied, so there is no signal of widespread automated exploitation. Exploitation is not fully unconditional despite PR:N - it requires the specific target to run the Stripe gateway, have a pending order to hijack, and the attacker to complete a smaller real (chargeable) payment against it, which introduces cost and setup friction. Net: a legitimate financial-fraud integrity issue worth patching, but its niche plugin footprint and preconditions keep effective priority LOW rather than the alarm implied by 'unauthenticated network' alone.

An attacker identifies a pending (unpaid) order on a store running Paymattic 4.6.20-4.6.25 with the Stripe gateway enabled, then initiates and confirms their own smaller Stripe payment, pointing the confirmation at the victim order's identifier. Because the plugin never verifies the confirmed payment actually belongs to that order, the pending order is marked fully paid, letting the attacker obtain goods/services or a donation credit far exceeding what they paid. Public exploit detail is available via WPScan.