medium5.3
CVE-2026-81740
The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret ke…
Impact
The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret key has not been configured, which is its state immediately after activation, allowing unauthenticated attackers to change the status of arbitrary orders, including marking unpaid orders as paid and reducing stock.
Affected products
| Product | Affected versions |
|---|---|
| Paytm Payment Gateway WordPress Plugin | before 2.8.9 |
Versions were read from the advisory text. No structured product data has been published for this record yet.