CVE-2026-89304

Name of the Vulnerable Software and Affected Versions paymendo WordPress plugin versions prior to 1.2

Description The plugin fails to properly sanitize and escape the paymendo bank transfer completed payment parameter before incorporating it into a SQL query. This flaw allows unauthenticated users to execute blind SQL injection attacks, a technique used to extract information from a database by observing the application's response to specific queries.

Recommendations Update the paymendo WordPress plugin to a version newer than 1.1. As a temporary mitigation, restrict access to the functionality utilizing the paymendo bank transfer completed payment parameter.