Medium severity · published Oct 2, 2026
CVE-2026-81740
Paytm Payment Gateway < 2.8.9 - Unauthenticated Order Status Manipulation via Payment Callback
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret key has not been configured, which is its state immediately after activation, allowing unauthenticated attackers to change the status of arbitrary orders, including marking unpaid orders as paid and reducing stock.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PP
Paytm Payment Gateway ·
before 2.8.9 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-81740
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-81740
exploit
https://wpscan.com/vulnerability/13767875-5010-494a-b3ed-133d58b8ecea/
More from Paytm Payment Gateway
7.5
CVE-2026-81809
Paytm Payment Gateway < 2.8.9 - Unauthenticated SQLi via Payment Callback
7.5
CVE-2026-81739
Paytm Payment Gateway < 2.8.9 - Unauthenticated Stored XSS via Payment Callback