CVE-2026-89305

Name of the Vulnerable Software and Affected Versions paymendo WordPress plugin versions prior to 1.2

Description The plugin fails to properly sanitize and escape the orderBy parameter before incorporating it into a SQL query. This flaw allows authenticated users to execute SQL injection attacks, which involve inserting malicious SQL code into a query to manipulate the database.

Recommendations Update the paymendo WordPress plugin to a version newer than 1.1. As a temporary workaround, restrict access to the functionality utilizing the orderBy parameter to minimize the risk of exploitation.