Skip to content
Sign in
5.3 Medium

CVE-2026-81740 The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate…

Description

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret key has not been configured, which is its state immediately after activation, allowing unauthenticated attackers to change the status of arbitrary orders, including marking unpaid orders as paid and reducing stock.

Affected products and versions

Product Affected versions Fixed in
Paytm Payment Gateway 2.8 earliest → < 2.8.9 2.8.9

Other CVEs of Paytm Payment Gateway

The 3 CVEs of Paytm Payment Gateway →
CVE-2026-81809 The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks… 7.5 High CVE-2026-81739 The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment… 7.5 High
Track this CVE