CVE-2026-89411 Paymattic CVE debrief

Who should care

Defenders responsible for WordPress installations using the Paymattic plugin should assess exposure and prioritize verification and remediation. This includes reviewing plugin versions, monitoring for potential abuse, and updating affected systems. Security teams and vulnerability management teams should also review the vulnerability and plan for potential impacts on their systems.

Why it matters

The Paymattic WordPress plugin vulnerability allows unauthenticated users to mark arbitrary orders as paid, which could lead to financial discrepancies and requires defenders to verify and update the plugin.

• Defenders must verify and update the Paymattic WordPress plugin to prevent potential abuse
• Unauthenticated users could mark arbitrary orders as paid, potentially leading to financial discrepancies

Technical summary

The Paymattic WordPress plugin, versions 4.6.20 through 4.6.26, does not verify that a confirmed Stripe payment belongs to the order it is applied to. This allows unauthenticated users to mark an arbitrary pending order as paid by confirming a smaller payment of their own against it. The vulnerability could lead to financial discrepancies if exploited. Defenders should prioritize verifying and updating the Paymattic WordPress plugin to version 4.6.26 or later, and monitor for potential abuse of this vulnerability. The vulnerability is a result of insufficient validation of Stripe payments in the Paymattic plugin.

Defensive priority

Defenders should prioritize verifying and updating the Paymattic WordPress plugin to version 4.6.26 or later, and monitor for potential abuse of this vulnerability.

Recommended defensive actions

• Verify and update the Paymattic WordPress plugin to version 4.6.26 or later
• Monitor for potential abuse of this vulnerability
• Review and update inventory of affected systems
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, indicating it affects Paymattic WordPress plugin versions between 4.6.20 and 4.6.26. Defenders should verify the plugin version and review Stripe payment configurations for potential exposure. The vulnerability allows unauthenticated users to mark arbitrary orders as paid by confirming a smaller payment against them.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.