CVE-2026-89411 — Paymattic < 4.6.26 - Unauthenticated Payment Bypass via Unbound Stripe PaymentIntent

CVE-2026-89411

Paymattic < 4.6.26 - Unauthenticated Payment Bypass via Unbound Stripe PaymentIntent PUBLISHED

Description (CNA)

The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe payment belongs to the order it is applied to, allowing unauthenticated users to mark an arbitrary pending order as paid by confirming a smaller payment of their own against it.

Affected (CNA)

Vendor / product	Versions
Unknown / Paymattic	affected 4.6.20 before 4.6.26

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/240a0440-7892-4c03-b282-2fdb6f086bb6/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.