CVE-2026-81648: Unauthenticated Authorization Bypass in CryptoPayment Gateway WordPress Plugin

Overview

A maximum-severity vulnerability has been disclosed in CryptoPayment Gateway, a WordPress plugin that lets sites accept cryptocurrency payments. Tracked as CVE-2026-81648, the flaw is a straightforward but devastating missing authorization check on one of the plugin's AJAX endpoints — the handler responsible for administrative operations never verifies that the caller is logged in or holds any privilege at all.

The result: any unauthenticated visitor can send a request to that endpoint and trigger admin-level actions, including deleting arbitrary files from the server, overwriting the plugin's payment gateway configuration, and retrieving stored cryptocurrency wallet credentials in cleartext.

The issue affects plugin versions 1.2.1 through 1.2.2, was assigned by WPScan, and was published on September 13, 2026 (CVE reserved August 27, 2026). Notably, the CryptoPayment Gateway listing on the WordPress.org plugin directory was closed pending review on August 28, 2026 — the day after the CVE was reserved — and is currently unavailable for new downloads. Sites that already have the plugin installed remain vulnerable regardless of the listing's status; a directory closure does not remove or patch existing installs.

Technical Details

How It Works

WordPress plugins commonly route AJAX requests (/wp-admin/admin-ajax.php?action=...) through handler functions that are each expected to run their own capability/nonce checks before doing anything privileged. CryptoPayment Gateway registered at least one such handler for administrative operations — file management, configuration updates, and credential retrieval — but never added the authorization check that should gate it to logged-in administrators.

Because admin-ajax.php is, by WordPress design, reachable by both authenticated and unauthenticated visitors (that's what lets logged-out users interact with public-facing AJAX features), an endpoint that skips its own authorization check is exposed to literally anyone who can reach the site over the network — no account, no session cookie, no user interaction beyond sending an HTTP request.

The disclosed impact spans three distinct privileged actions reachable through the same unguarded router:

• Arbitrary file deletion — an attacker can direct the endpoint to delete files on the server, which can be used destructively (breaking the site) or as a stepping stone toward further compromise (e.g., deleting a .htaccess or security-plugin file that would otherwise block later attacks).
• Configuration overwrite — the plugin's payment gateway settings can be rewritten outright, which for a cryptocurrency payment processor could mean redirecting customer payments to an attacker-controlled wallet address.
• Cleartext wallet credential exposure — stored wallet credentials can be read back from the plugin's configuration in plaintext, handing the attacker direct access to funds or keys the plugin was trusted to protect.

Impact Assessment

This is about as severe as a WordPress plugin vulnerability gets, which is reflected in the maximum possible CVSS base score of 10.0. The combination of zero authentication, zero required interaction, network reachability, and high confidentiality/integrity/availability impact means a single crafted HTTP request is enough to fully compromise the plugin's trust boundary.

Because CryptoPayment Gateway specifically handles cryptocurrency payments, the practical consequences go beyond typical "site defacement" WordPress bugs:

• Direct financial exposure — cleartext wallet credential disclosure can translate directly into stolen funds, not just data exposure.
• Payment redirection — an attacker who overwrites the gateway configuration could silently reroute customer cryptocurrency payments to a wallet they control.
• Site availability/integrity risk — unrestricted arbitrary file deletion can be used to disrupt the site or clear the way for further compromise (e.g., removing security controls before a follow-on attack).

The vulnerability's EPSS score is currently very low and it has not been added to CISA's KEV catalog, so there is no confirmed evidence of active, widespread exploitation as of this writing. That said, EPSS scores for freshly disclosed, low-complexity, unauthenticated flaws can shift quickly once scanning activity picks up, and the bar to exploit this one is low — treat the absence of confirmed in-the-wild activity as "not yet observed," not "safe."

Affected Versions

No official patched release has been confirmed by NVD, WPScan, or OpenCVE as of this article's publication. Compounding the problem, the plugin's listing on the WordPress.org directory was closed pending review on August 28, 2026, which means site owners cannot currently obtain any newer build through the normal update mechanism even if one were released — check the plugin's WordPress.org page directly for its current status before assuming an in-dashboard update will appear.

Mitigation

Because there is no confirmed patched version and the plugin is not currently available through the WordPress.org directory, treat this as an unpatched, actively-unsupported-for-now vulnerability:

• Deactivate and remove CryptoPayment Gateway immediately if you're running it, especially given the plugin directly handles payment credentials. This is the only fully reliable mitigation until an official fix ships.
• If you cannot remove it immediately, block requests to admin-ajax.php from unauthenticated sessions at the WAF or reverse-proxy layer, or restrict access to the endpoint by IP, as a stop-gap — understanding this is a compensating control, not a fix.
• Assume wallet credentials stored by the plugin are compromised if it has been active and internet-facing since before you applied mitigations. Rotate any associated wallet keys/credentials and review recent transaction history for anomalies.
• Check for unexpected file deletions and configuration changes in the plugin's settings and on the filesystem generally; the endpoint permits both.
• Monitor WPScan and Patchstack for a fixed release or an official statement from the plugin author, and re-evaluate before reinstalling.
• General guidance: every AJAX action registered via wp_ajax_* / wp_ajax_nopriv_* needs its own explicit capability check (current_user_can()) and nonce verification — registering a handler under the privileged wp_ajax_ hook alone does not restrict who can call it if the handler is also reachable through wp_ajax_nopriv_ or omits the check entirely.

Sources

• NVD — CVE-2026-81648
• WPScan Vulnerability Database
• OpenCVE — CVE-2026-81648