CVE-2026-89304
Received Received - Intake

Blind SQL Injection in Paymendo WordPress Plugin

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: WPScan

Description
The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform blind SQL injection attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-89304
EUVD
EUVD-2026-96791

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown paymendo 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability CVE-2026-89304 affects the Paymendo Bank Transfer WordPress plugin version 1.1 or below. It is an unauthenticated blind SQL injection flaw caused by improper sanitization and escaping of the 'paymendo_bank_transfer_completed_payment' parameter in SQL queries. This allows attackers to manipulate database queries without needing authentication.

Detection Guidance

To detect this vulnerability, check if the Paymendo WordPress plugin version 1.1 or below is installed. Look for unusual database query patterns or errors in logs. No specific commands are provided, but monitoring SQL query logs for blind SQL injection attempts may help.

Impact Analysis

This vulnerability allows unauthenticated attackers to perform blind SQL injection attacks, potentially leading to unauthorized access to sensitive data, database manipulation, or complete system compromise. Attackers could extract, modify, or delete database contents without valid credentials.

Compliance Impact

This vulnerability could lead to unauthorized data access or breaches, violating GDPR and HIPAA requirements for data protection and confidentiality. Non-compliance may result in legal penalties, fines, or reputational damage due to exposed sensitive information.

Mitigation Strategies

Immediately uninstall or disable the Paymendo WordPress plugin if you are using version 1.1 or below. Since no patch is available, consider alternative payment plugins until a fix is released. Monitor for suspicious activity in database logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89304. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart