CVE-2026-81740: Paytm Payment Gateway < 2.8.9 - Unauthenticated Order Status Manipulation via Payment Callback

Q: Which installations are exposed?

Paytm Payment Gateway WordPress plugin versions before 2.8.9 are exposed when the plugin's secret key has not been configured. The description states this is the state immediately after activation.

Q: What does an attacker need to exploit this issue?

An attacker does not need authentication or user interaction. They can exploit payment callbacks that are not verified as genuinely originating from the payment provider when no secret key is configured.

Q: What is the practical impact of successful exploitation?

An attacker can change the status of arbitrary orders, including marking unpaid orders as paid. This can also reduce inventory stock.

Q: What can be done if the plugin cannot be updated immediately?

Configure the payment provider secret key so that payment callbacks can be verified. The vulnerability is described as occurring when that key has not been configured.

Published Oct 2, 2026

Updated

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret key has not been configured, which is its state immediately after activation, allowing unauthenticated attackers to change the status of arbitrary orders, including marking unpaid orders as paid and reducing stock.

Affected Software

1 affected component

Paytm Paytm Payment Gateway WordPress plugin<2.8.9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Paytm Payment Gateway WordPress plugin to a version that resolves this vulnerability.
Fixed in 2.8.9

Event History

Oct 2, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are exposed?

Paytm Payment Gateway WordPress plugin versions before 2.8.9 are exposed when the plugin's secret key has not been configured. The description states this is the state immediately after activation.

What does an attacker need to exploit this issue?

An attacker does not need authentication or user interaction. They can exploit payment callbacks that are not verified as genuinely originating from the payment provider when no secret key is configured.

What is the practical impact of successful exploitation?

An attacker can change the status of arbitrary orders, including marking unpaid orders as paid. This can also reduce inventory stock.

What can be done if the plugin cannot be updated immediately?

Configure the payment provider secret key so that payment callbacks can be verified. The vulnerability is described as occurring when that key has not been configured.

CVE-2026-81740: Paytm Payment Gateway < 2.8.9 - Unauthenticated Order Status Manipulation via Payment Callback

Affected Software

Remediation

Event History

Frequently Asked Questions

Which installations are exposed?

What does an attacker need to exploit this issue?

What is the practical impact of successful exploitation?

What can be done if the plugin cannot be updated immediately?

Company

Resources

Contact

Frequently Asked Questions

Which installations are exposed?

What does an attacker need to exploit this issue?

What is the practical impact of successful exploitation?

What can be done if the plugin cannot be updated immediately?