Description

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret key has not been configured, which is its state immediately after activation, allowing unauthenticated attackers to change the status of arbitrary orders, including marking unpaid orders as paid and reducing stock.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-10-02T06:16:41.450Z",
  "pubdate": "2026-10-02T06:16:41.450Z",
  "executiveSummary": "The Paytm Payment Gateway WordPress plugin before version 2.8.9 is susceptible to an authentication bypass vulnerability due to improper verification of payment callback integrity.\nThis vulnerability originates from the plugin's failure to enforce callback validation when the merchant secret key remains unconfigured in its default post-activation state.\nThe flaw allows unauthenticated remote attackers to forge payment success notifications, effectively manipulating the integrity of the order management system.\nThe impact includes the unauthorized marking of unpaid orders as 'paid' and potential inventory manipulation, leading to financial loss and service disruption.\nExploitation requires no prior authentication or administrative privileges, as the vulnerability exists within the public-facing callback endpoint. The risk is high for e-commerce operators who fail to finalize the configuration of the plugin immediately upon installation.",
  "technicalDetails": "The vulnerability resides in the callback processing logic of the Paytm Payment Gateway WordPress plugin. Upon activation, the plugin maintains a state where the cryptographic secret key—required to verify the authenticity of incoming payment status updates (IPNs)—is not yet defined by the administrator.\nThe root cause is an insecure conditional check within the callback handling function. The implementation fails to enforce a 'fail-closed' security posture; instead of rejecting requests when the configuration is missing or invalid, the plugin proceeds to process the callback payload as if it were authentic.\nAttackers can leverage this by crafting arbitrary HTTP requests directed at the plugin's callback endpoint. Because the system does not validate the HMAC signature or checksum of the incoming data due to the unconfigured secret, the application accepts the forged payload.\nThe attack flow follows these steps: 1) The attacker identifies the publicly accessible callback URL managed by the plugin. 2) The attacker crafts a request mimicking a successful Paytm transaction, specifying a targeted Order ID. 3) Since the merchant secret key check is bypassed, the plugin logic interprets the forged request as a legitimate notification from the payment gateway. 4) The plugin executes the internal order status update function, transitioning the order status from 'pending' or 'failed' to 'processing' or 'completed' within the WordPress database.\nThis post-exploitation behavior results in the automatic fulfillment of orders without actual financial settlement. Furthermore, if the payment success triggers inventory management hooks within WooCommerce or the base platform, the attacker may trigger an artificial reduction in stock levels, potentially leading to inventory depletion of products. The vulnerability is present in all versions prior to 2.8.9, affecting any deployment where the administrator has not strictly enforced the plugin's security configuration immediately upon activation. The exploit is entirely network-accessible and requires no interaction from the target merchant, making it a critical risk for automated exploitation via botnets."
}