Vulnerability · Published Oct 1, 2026 · Assigned by WPScan
CVE-2026-81809Paytm Payment Gateway < 2.8.9 - Unauthenticated SQLi via Payment Callback
High 7.5
In plain English
A high-severity SQL injection in Paytm Payment Gateway from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.2%top 91.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks before using it in a SQL statement, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to perform SQL injection attacks.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Paytm Payment Gateway | 0 – before 2.8.9 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
References
- https://wpscan.com/vulnerability/10f2d49e-94e4-4e49-b32f-c1c75c2c6364/ exploit, vdb-entry, technical-description