CVE-2026-81809

{
  "etk_id": "ETK-2026-536",
  "cve_id": "CVE-2026-81809",
  "display_id": "CVE-2026-81809",
  "ghsa_id": "GHSA-x2j9-6g95-5p2v",
  "euvd_id": "EUVD-2026-90510",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated SQL injection in Paytm Payment Gateway",
  "summary": "Paytm Payment Gateway for WordPress versions before 2.8.9 are affected by SQL injection through payment callback handling. An unauthenticated attacker may manipulate database queries when the gateway is enabled without configured credentials.",
  "mitigation": "Upgrade Paytm Payment Gateway to version 2.8.9 or later. Until the upgrade is complete, do not enable the gateway without credentials configured.",
  "vendor": null,
  "product": "Paytm Payment Gateway",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 2.8.9"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.8.9"
      ],
      "package_name": "Paytm Payment Gateway",
      "purl": null
    }
  ],
  "cwes": [
    89
  ],
  "cvss_score": 7.5,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N",
  "epss_score": 0.0019,
  "epss_percentile": 0.0759,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 28.10775161666667,
  "t0_at": "2026-10-01T06:00:24.153000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-01T06:00:24.153000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-01T06:00:24.153000+00:00",
      "url": "https://github.com/advisories/GHSA-x2j9-6g95-5p2v"
    }
  }
}