blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-81648

CRITICAL 10.0 CVSS 3.1
Published
September 13, 2026
Last modified
November 3, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-862
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Description

The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext.

Affected products and versions

  • Unknown CryptoPayment Gateway — From 1.2.1 (including) to 1.2.2 (including)

References

  • wpscan.com https://wpscan.com/vulnerability/9b1490a0-1381-4d22-8086-f75aade4e898/
  • nvd.nist.gov Official NVD record