CVE-2026-81648CWE-862broken-access-control

CVE-2026-81648

Critical · published September 14, 2026

CVSS v3.1
10.0
EPSS
0%
Percentile
41.8
In the wild
Unconfirmed
What it is

The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext.

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00498 · 41.8th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-14T01:17Z
References (1)
https://wpscan.com/vulnerability/9b1490a0-1381-4d22-8086-f75aade4e898/ · [email protected]
EPSS history
Timeline
  • 15 SEP 03:22Z
    EPSS moved — → 0%
    epss
  • 13 SEP 20:06Z
    CryptoPayment Gateway 1.2.1 - 1.2.2 - Unauthenticated Arbitrary File Deletion and Settings Update via Unguarded AJAX Router
    cvelistv5