CVE-2026-81648

CVE Enrichment

CVSS: 10.0 CRITICAL
EPSS: 0.50%
EPSS Percentile: 42.71%
CISA KEV: Not listed

Description

The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 14-Sep-2026 04:17
Last Modified: 15-Sep-2026 04:10
EPSS Date: 2026-11-02
CWE: CWE-862

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:C /
                            C:H /
                            I:H /
                            A:H

CNA Products / Version Status

Unknown · CryptoPayment Gateway Source: CNA · [email protected]
Default status: unknown

1.2.1 ≤ version ≤ 1.2.2 — affected (semver)

collectionURL: https://wordpress.org/plugins

References

[email protected]

Last enrichment sync: 03-Nov-2026 16:10
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

The vulnerability in question is CVE-2026-81648, which carries a CVSS score of 10.0. Successful exploitation of the flaw could permit unauthenticated users to delete arbitrary files on the server and extract sensitive Attackers Attempt to Exploit Unpatched CryptoPayment Gateway WordPress Flaw

MITRE ATT&CK (1)

Products (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.