WordPress Paymattic plugin 4.6.20-4.6.25 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Artus KG in WordPress Plugin Best Payments Plugin for WP versions 4.6.20-4.6.25...

CVE-2026-89411

The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe payment belongs to the order it is applied to, allowing unauthenticated users to mark an arbitrary pending order as paid by confirming a smaller payment of their own against it...

CVE-2026-89411 Paymattic < 4.6.26 - Unauthenticated Payment Bypass via Unbound Stripe PaymentIntent

The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe payment belongs to the order it is applied to, allowing unauthenticated users to mark an arbitrary pending order as paid by confirming a smaller payment of their own against it...

EUVD-2026-88101

The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe payment belongs to the order it is applied to, allowing unauthenticated users to mark an arbitrary pending order as paid by confirming a smaller payment of their own against it...

CVE-2026-89411

The Paymattic WordPress plugin (versions 4.6.20 through 4.6.25) contains a vulnerability where it fails to verify that a confirmed Stripe payment corresponds to the specific order it is being applied to. This flaw allows unauthenticated users to perform an unauthenticated payment bypass by confir...