CVE-2026-81809 — Paytm Payment Gateway < 2.8.9 - Unauthenticated SQLi via Payment Callback

CVE-2026-81809

Paytm Payment Gateway < 2.8.9 - Unauthenticated SQLi via Payment Callback PUBLISHED

Description (CNA)

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks before using it in a SQL statement, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to perform SQL injection attacks.

Affected (CNA)

Vendor / product	Versions
Unknown / Paytm Payment Gateway	affected 0 before 2.8.9

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/10f2d49e-94e4-4e49-b32f-c1c75c2c6364/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.