CRITICAL CWE-862
CVE-2026-81648
CryptoPayment Gateway 1.2.1 - 1.2.2 - Unauthenticated Arbitrary File Deletion and Settings Update via Unguarded AJAX Router
10.0/ 10
CVSS 3.1
Critical severity
0.50%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 43% of all CVEs
Not listed
CISA KEV catalog
No confirmed in-the-wild exploitation on CISA's list, but a public proof of concept exists.
Timeline
- Published
- Sep 13, 2026
- Updated
- Nov 3, 2026
- First covered
- Nov 3, 2026
- Latest story
- 2 weeks ago
Summary
The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext.
CWE-862Missing Authorization
Attack profile
Attack vectorNetwork
ComplexityLow
PrivilegesNone
User interactionNone
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HAffected products
- CryptoPayment Gateway1.2.1 to 1.2.2