Skip to content
Sign in
7.5 High

CVE-2026-81809 The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks…

Description

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks before using it in a SQL statement, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to perform SQL injection attacks.

Affected products and versions

Product Affected versions Fixed in
Paytm Payment Gateway 2.8 earliest → < 2.8.9 2.8.9

Other CVEs of Paytm Payment Gateway

The 3 CVEs of Paytm Payment Gateway →
CVE-2026-81740 The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate… 5.3 Medium CVE-2026-81739 The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment… 7.5 High
Track this CVE