Search/CVE-2026-81648
● CVE — Critical

CVE-2026-81648

DiscoveredSep 13, 2026UpdatedNov 3, 2026

The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext.

View graph Watch Export
CVSS v3.1
10 CRITICAL
EPSS
0.50%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
1
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Sep 15, 2026 → Sep 25, 2026
▲ 0.22pp
0.28% → 0.50% over 2 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Connections
2 relationships
Timeline
disclosure → media coverage
Sep 13, 2026
Disclosure — published as a CVE record. · last revised by NVD Nov 3, 2026
Nov 3, 2026
thehackernews.com reports: Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials
Public PoC (1)
github.com/abraxas/CVE-2026-81648
Unverified third-party code — review before executing.