CVE-2026-81809

HighCVSS 7.5

Published: 01/10/2026(UTC)Updated: 01/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Summary

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks before using it in a SQL statement. The integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to perform SQL injection attacks.

Risk Assessment

An attacker can execute arbitrary SQL queries, potentially leading to data leakage, database modification, or full site compromise.

Recommendation

Update the Paytm Payment Gateway plugin to version 2.8.9 or later. Ensure the gateway is configured with valid credentials.

Other vulnerabilities in Paytm Payment Gateway WordPress plugin

CVE-2026-81739High
The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin page. The integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to store scripts that will run in the session of a store administrator.

Original NVD description (English source)

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks before using it in a SQL statement, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to perform SQL injection attacks.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS