Unsecured Payment Gateway Plugin for WordPress Exposes Administrators to Script Execution
CVE-2026-81739
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 1 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-81739?
The Paytm Payment Gateway plugin for WordPress prior to version 2.8.9 is vulnerable due to the lack of proper sanitization and escaping of payment callback data. This allows unauthenticated users to manipulate the data stored on admin pages, potentially injecting malicious scripts. Furthermore, the integrity checks on payment callbacks can be bypassed if the gateway is enabled without required credentials, thereby compromising the security of the WordPress administration interface.
Affected Version(s)
Paytm Payment Gateway 0 < 2.8.9
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.