CVE-2026-89304: CWE-89 SQL Injection in paymendo

CVE-2026-89304 describes a SQL injection vulnerability in the paymendo WordPress plugin versions up to and including 1.1. The vulnerability arises because the plugin does not properly sanitize and escape a parameter before incorporating it into a SQL query. This allows unauthenticated attackers to conduct blind SQL injection attacks, potentially enabling them to extract or manipulate database information without authentication.

An attacker can exploit this vulnerability to perform blind SQL injection attacks without authentication. This could lead to unauthorized access to or manipulation of the underlying database used by the paymendo plugin. The exact impact depends on the database contents and the privileges of the database user, but it generally poses a risk to data confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the paymendo plugin or restricting access to it to trusted users only to reduce exposure.