CVE-2026-89304

13th percentile - higher than 13% of all known CVEs

The paymendo WordPress plugin through version 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform blind SQL injection attacks.

The risk includes the possibility of reading sensitive data from the database without authentication, which can lead to information leakage, privacy breach, or further attacks. The attack can be performed remotely.

Update the paymendo plugin to the latest version if available. If not, disable the plugin until a fix is released or apply additional protections (e.g., WAF).