CVE-2026-89304 PUBLISHED

Paymendo Bank Transfer <= 1.1 - Unauthenticated Blind SQLi via 'paymendo_bank_transfer_completed_payment' Parameter

Assigner: WPScan
Reserved: 11.09.2026 Published: 11.10.2026 Updated: 11.10.2026

The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform blind SQL injection attacks.

Product Status

Vendor Unknown
Product paymendo
Versions Default: unknown
  • affected from 0 to 1.1 (incl.)

Credits

  • Enrico Marcolini - Claudio Marchesini - Dottor Marc finder
  • WPScan coordinator

References

Problem Types

  • CWE-89 SQL Injection CWE