CVE-2026-89305

MediumCVSS 6.5

Published: 11/10/2026(UTC)Updated: 13/10/2026(UTC)Translated: 11/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

11th percentile - higher than 11% of all known CVEs

Summary

The paymendo WordPress plugin through version 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks.

Risk Assessment

The risk includes unauthorized database access, data modification or deletion, and in extreme cases server compromise. Authenticated users can exploit this vulnerability.

Recommendation

Update the paymendo plugin to the latest version if available. If not, disable the plugin until a fix is released or apply additional protections (e.g., WAF).

Other vulnerabilities in paymendo

CVE-2026-89304Medium
The paymendo WordPress plugin through version 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform blind SQL injection attacks.

Original NVD description (English source)

The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS