Paytm Payment Gateway EUVD-2026-90510

Exploitation requires that the Paytm Payment Gateway is enabled on the WordPress site WITHOUT credentials configured - in this state the integrity/signature check on incoming payment callbacks can be forged by an unauthenticated attacker. The vulnerable sink is a SQL statement that consumes unescaped data taken from the payment callback. Limiting factors: the credential-less gateway configuration is a specific, non-universal deployment state; the high attack complexity (AC:H) reflects the effort to construct a forged callback that passes the (forgeable) integrity check; and the site must be running a version before 2.8.9. No authentication or user interaction is required once those conditions hold.

The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N = 7.5 HIGH) describes an unauthenticated (PR:N), network-reachable SQL injection with high attack complexity (AC:H) and a scope change (S:C) reflecting injection into the backend WordPress/MySQL database. The AC:H is credible because exploitation requires forging the payment-callback integrity check, which is only feasible in the specific configuration where the gateway is enabled without credentials - not a trivial one-shot request. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this is a vendor/researcher-disclosed (WPScan) issue rather than an observed in-the-wild threat. Net: a genuine high-impact SQLi (C:H enables database read, including credentials/PII) but gated behind both a non-default credential-less configuration and non-trivial callback forgery, so real-world priority is moderate - patch promptly on affected sites but the AC:H plus configuration gate argues against imminent mass exploitation. Note the vector assigns only I:L and A:N despite SQLi often permitting writes; this likely reflects limited injection context - treat integrity impact as conservative and verify against the WPScan advisory.

An attacker who knows a WordPress site runs the Paytm Payment Gateway plugin (<2.8.9) with the gateway enabled but no API credentials configured crafts a forged payment-callback request, bypassing the integrity check that would normally require valid gateway credentials. The malicious callback carries SQL metacharacters in a callback-derived field that the plugin fails to escape before using in a SQL statement, letting the attacker read arbitrary database contents (order data, user records, password hashes). No public POC is referenced, and the high attack complexity reflects the effort to forge a valid-looking callback.