CVE-2026-81809

Summary

The Paytm Payment Gateway WordPress plugin contains a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL commands on the database. This occurs when payment callbacks are processed without proper data escaping, and can be exploited when the gateway is enabled without credentials.

Exploitability

Exploitation requires an unauthenticated attacker to trigger a payment callback with forged integrity checks, making it moderately difficult but possible with knowledge of the callback endpoint structure.

Blast radius

If exploited, attackers could read sensitive customer data, modify payment records, or potentially escalate to full database compromise affecting all WordPress plugin data and user information.

Detection

Monitor for unusual SQL queries in database logs that contain user-supplied callback parameters, particularly those with malformed or unexpected data patterns from payment gateway endpoints.

Prioritized remediation

Upgrade to version 2.8.9 or later to fix the SQL injection vulnerability in the Paytm Payment Gateway plugin.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.