CVE-2026-81739
HighCVSS 7.5Summary
The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin page. The integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to store scripts that will run in the session of a store administrator.
Risk Assessment
An attacker can inject malicious scripts that execute in the admin context, potentially leading to admin account takeover or unauthorized actions.
Recommendation
Update the Paytm Payment Gateway plugin to version 2.8.9 or later. Configure the gateway with valid credentials to prevent callback forgery.
Other vulnerabilities in Paytm Payment Gateway WordPress plugin
Original NVD description (English source)
The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin page, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to store scripts that will run in the session of a store administrator.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS