CVE-2026-81740

Name of the Vulnerable Software and Affected Versions Paytm Payment Gateway WordPress plugin versions prior to 2.8.9

Description When the secret key is not configured, which occurs immediately after activation, the plugin fails to verify that payment callbacks originate from the legitimate payment provider. This allows unauthenticated attackers to modify the status of arbitrary orders, such as marking unpaid orders as paid and reducing stock levels.

Recommendations Update the plugin to version 2.8.9 or later. Ensure the secret key is properly configured immediately after activation to enable callback verification.