shouldiuse.io

Categories

VERDICT

Payload Review

Depends

Should I use Payload?

Built with TypeScript and React, Payload is an open-source headless CMS and application framework. Build anything. - payloadcms.com

· 1 month ago

Buy if you have React/TypeScript developers who want a code-first CMS they can self-host. Skip if you need a no-code tool, a simple blog CMS, or a stable vendor roadmap post-acquisition.

Confidence

Medium. Based on ~15 usable public sources; many 'payload' search results (space, cybersecurity jargon, a separate payments company) were excluded as unrelated.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support quality
  • Security posture

Pricing

Free

Open-source / self-hosted

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
Payload CloudPaid managed hosting

Best for

  • and React dev teams
  • Custom apps that need a CMS
  • Complex marketing sites
  • Teams wanting self-hosting control

Not for

  • Marketers wanting a plug-and-play WordPress swap
  • Non-technical teams without React developers
  • Simple blogs or contact sites — WordPress or Ghost cost less effort
  • Risk-averse buyers spooked by the Figma acquisition

Gotchas - check before you buy

high

Auth bypass and RCE CVEs fixed in 3.79.1+; always run latest version

medium

Cloud pricing is the top complaint; self-host to control costs

medium

Self-hosting means upgrades, backups, and patches are your job

medium

Post-Figma roadmap uncertainty has users evaluating alternatives already

Pros and cons

Pros

  • Rated 4.9/5 across 59 G2 reviews
  • Free open-source core; self-host anywhere
  • Native TypeScript/React fits teams without glue code
  • Users consistently praise flexibility and extensibility

Cons

  • Steep learning curve without knowledge
  • Cloud hosting pricing draws repeated complaints
  • Figma acquisition leaves roadmap uncertain; users exploring alternatives
  • Small review base versus bigger CMS rivals
  • Some developers find the admin experience painful

Sources & method

- 12 sources - Recent auth bypass and RCE CVEs patched in 3.79.1+; security page exists.

official x2review x6security x2news x2
  • CVE-2026-25574: Auth bypass vulnerability, Disclosed authentication bypass affecting Payload CMS.
  • CVE-2026-25544: Remote code execution, Critical RCE patched in version 3.79.1 and later.

Key stats

  • Value for money: 4/5

    Rating

  • Free

    Starting price

  • 12

    Sources

  • Analyzed

  • Value for money: 4/5. Free open-source core; cloud hosting costs draw complaints
  • Ease of use: 3/5. Code-first setup; developers report friction
  • Feature depth: 4/5. Config-driven CMS that extends into full apps
  • Support quality: 3/5. Active community; vendor support evidence thin
  • Security posture: 3/5. Recent CVEs, patched; public disclosure process
  • 4.9/5 G2 rating 59 reviews
  • Yes Free tier Open-source core, self-hosted
  • $9M Series A Funding VC-backed startup
  • 394 Companies using Tracked by TheirStack

Pricing

Open-source / self-hosted

Free

  • Full CMS and admin UI
  • You manage hosting and updates

Payload Cloud

Paid managed hosting

  • Hosted for you
  • Frequently called out as expensive

Security

Recent auth bypass and RCE CVEs patched in 3.79.1+; security page exists.

  • CVE-2026-25574: Auth bypass vulnerabilityDisclosed authentication bypass affecting Payload CMS.⁸
  • CVE-2026-25544: Remote code executionCritical RCE patched in version 3.79.1 and later.⁹

What users say

Users rate Payload extremely highly on flexibility, but flag the React learning curve, cloud pricing, and post-acquisition uncertainty.

“Is payload CMS a good option for me if I don't know nextjs?”
Reddit, r/PayloadCMS
“Anyone else find Payload CMS a pain?”
Reddit, r/nextjs
“Which CMS to use now? The future of Payload is uncertain”
Reddit, r/nextjs

Companies that use it

  • Sonos
  • DigitalOcean
  • Blue Origin
Full analysis

Based on ~15 usable public sources; many 'payload' search results (space, cybersecurity jargon, a separate payments company) were excluded as unrelated.

Powerful code-first CMS devs rate 4.9/5, but it needs React skills, self-hosting for value, and the roadmap is murky.

Methodology

Based on ~15 usable public sources; many 'payload' search results (space, cybersecurity jargon, a separate payments company) were excluded as unrelated.

Read how a report is made.

Sources

  1. Payload: The Next.js Headless CMS and App Frameworkpayloadcms.com
    official
  2. Payload Products | Read 59 Reviews on G2g2.com
    review
  3. Payload CMS Reviews 2026 | G2g2.com
    review
  4. Payload CMS Reviews 2026 | Capterracapterra.com
    review
  5. What is the huge push by Payload CMS? | Redditreddit.com
    review
  6. Anyone else find Payload CMS a pain? | Redditreddit.com
    review
  7. Which CMS to use now? | Redditreddit.com
    review
  8. CVE-2026-25574: Payload CMS Auth Bypass | SentinelOnesentinelone.com
    security
  9. CVE-2026-25544 Payload CMS RCE | Action1action1.com
    security
  10. Payload Raises $9M Series A | The SaaS Newsthesaasnews.com
    news
  11. Payload CMS Alternatives After the Figma Acquisition | Cosmiccosmicjs.com
    news
  12. Payload CMS Pricing 2026 | Build with Matijabuildwithmatija.com
    official

Add this review to your site

This check for Payload says Depends.

Put the badge on your site.

Visitors see the independent review.

The link points here, and search engines follow it.

This is the badge visitors see on your site.

Depends Payload Independent review on Should I Use It

Paste one snippet. Keep the link as it is. A nofollow tag stops search engines from following it.

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.