CVE-2026-81648: Unauthenticated Admin Access in WordPress

CryptoPayment Gateway 1.2.1–1.2.2: unauthenticated AJAX bypass, CVSS 10.0 critical. Urgent patch required.

CVE-2026-81648 affects the CryptoPayment Gateway plugin for WordPress in versions 1.2.1 and 1.2.2. The vulnerability lies in the absence of authorization checks on one of the plugin's AJAX endpoints, allowing unauthenticated users to invoke administrative operations. This directly impacts millions of WordPress sites running this plugin for cryptocurrency payment processing.

The CVSS 10.0 score reflects maximum criticality: the flaw enables arbitrary file deletion from the server, modification of payment gateway configuration, and recovery of wallet credentials in cleartext. Social signals (unverified) report ongoing exploitation attempts as of November 2, 2026, though official NVD data from September 13 do not yet confirm widespread exploitation. The absence of public GitHub repositories with exploit code does not rule out current risk.

WordPress administrators must update the CryptoPayment Gateway plugin beyond version 1.2.2 (fixed version not yet officially reported in NVD data). In the interim: immediately audit AJAX access logs, verify integrity and ownership of critical files, force a reset of all stored wallet credentials. If the plugin is not essential, disable it until an official verified patch is released.

At a glance

What: CryptoPayment Gateway plugin for WordPress, versions 1.2.1-1.2.2. Authorization check bypass on AJAX endpoint allows unauthenticated users to invoke administrative operations.
Severity: CVSS 10.0, critical. Enables arbitrary file deletion from server, payment gateway configuration modification, wallet credential access in cleartext.
Affected versions: 1.2.1, 1.2.2
Fix: Not reported in NVD documentation. Update beyond version 1.2.2.
Status: X signals (unverified) report ongoing exploitation attempts as of November 2, 2026. No confirmed public GitHub repository with exploit code.
Action: Immediate plugin update. Full audit of AJAX access logs, verify file integrity and ownership, reset all stored wallet credentials, disable if not essential.

Sources: NVD, CVE-2026-81648

← All articles