The Paymendo WordPress plugin up to version 1.1 does not properly sanitize the 'paymendo_bank_transfer_completed_payment' parameter before incorporating it into a SQL query. As a result, unauthenticated users can perform blind SQL injection and retrieve sensitive data from the database. This flaw directly undermines the confidentiality and integrity of the site’s stored information.

WordPress installations that have the Paymendo plugin installed and running a version equal to or earlier than 1.1 are affected. The vendor is listed as Unknown:paymendo, so any site relying on this plugin is at risk.

The vulnerability has a CVSS score of 6.5 and an EPSS score of <1%, and is not listed in the CISA KEV catalog, but it can be exploited by any external actor without authentication through the vulnerable plugin endpoint. The lack of input validation and sanitization makes exploitation relatively straightforward for attackers who can send crafted requests to the plugin. Given the severity of potential data exposure, the risk remains high pending a patch.