CVE-2026-44584

Name of the Vulnerable Software and Affected Versions Paymenter versions prior to 1.5.0

Description The email update functionality fails to invalidate the existing verification state when a user changes their email address. This allows a verified account to retain its verified status after switching to an unverified or unowned email address because the system does not reset or revalidate the associated email verification status, leaving the verification column set to "true". This can lead to misrepresentation of email ownership, bypass of verification-based trust assumptions, and abuse of features gated behind verified status.

Recommendations Update to version 1.5.0.