01 · The Real Story
An unlocked back door to the crypto cash register
The CryptoPayment Gateway WordPress plugin versions 1.2.1–1.2.2 exposes an AJAX action with no authorization or nonce check. A remote unauthenticated POST to the plugin endpoint can delete arbitrary files, overwrite the payment gateway configuration, and recover stored cryptocurrency wallet credentials in cleartext. No patch exists as of the latest vendor advisory.
The vendor's CRITICAL 10.0 is warranted for affected stores: arbitrary file deletion can become RCE by deleting wp-config.php, and cleartext wallet keys make this an immediate financial theft tool. The only real-world narrowing is the plugin's small install base; for any host that runs it, the severity remains critical, and active exploitation attempts in the wild remove any argument to downgrade.
"Unpatched missing-auth AJAX lets any visitor delete files, rewrite payment config, and read wallet keys in cleartext"
02 · The Attack Path
5 steps from start to impact.
STEP 01
Find an internet-facing WordPress site running CryptoPayment Gateway
The attacker scans for WordPress installs and fingerprints the plugin via its readme.txt, directory listing, or a known asset in
/wp-content/plugins/cryptopayment-gateway/. No authentication is needed to probe; public search indexes and Shodan-style scans can identify candidates.Conditions required:
- Target uses WordPress
- Plugin version 1.2.1–1.2.2 installed
- Website reachable over HTTP/HTTPS
Where this breaks in practice:
- Plugin has a small install base relative to all WordPress sites, so automated mass scans find few candidates
- Some WordPress hardening hides plugin readme or disables directory listing
Detection/coverage: No dedicated Shodan module; manual curl check or custom nuclei template can fingerprint.
STEP 02
Send unauthenticated POST to the missing-auth AJAX endpoint
The attacker calls the vulnerable AJAX action directly, either via
/wp-admin/admin-ajax.php or the plugin's own endpoint in vendor/cryptd/ajax.php. The handler performs no capability check, nonce validation, or user authentication, so the request executes with administrative privileges.Conditions required:
- Remote network access
- Exact AJAX action name known or guessed (public PoC available)
Where this breaks in practice:
- A WAF may block obvious admin-ajax abuse, but custom endpoint requests often bypass generic rules
- Some hosts may have the plugin deactivated, which stops the AJAX routes
Detection/coverage: Web server access logs show anomalous POSTs to plugin AJAX; SIEM rules can flag repeated requests from single IPs, but default WordPress logging typically misses authorization failures.
STEP 03
Delete arbitrary files via path traversal in the file deletion call
One of the exposed admin operations deletes server files without path validation. The attacker supplies a crafted filename/path to remove
wp-config.php, .htaccess, or security plugin files. Deleting wp-config.php can trigger the WordPress install process, allowing the attacker to supply a remote database and execute PHP code.Conditions required:
- Web server user has write/delete permissions on target files (common for WordPress uploads/core)
- The vulnerable action accepts arbitrary path input
Where this breaks in practice:
- Read-only file permissions or hardened filesystem might limit deletion
- Deleting wp-config.php may cause immediate outage alerting, increasing detection, but exploitation can be automated quickly
Detection/coverage: File integrity monitoring (FIM) detects the deletion; logs may show missing file events, but native WordPress logging does not record the PHP delete call.
STEP 04
Overwrite payment gateway config and recover cleartext wallet credentials
The same unauthorized admin operations allow changing the merchant wallet address to an attacker-controlled value, redirecting customer crypto payments. The plugin stores wallet credentials in cleartext; an unauthenticated call returns them directly, enabling the attacker to drain existing wallets from any device.
Conditions required:
- Plugin holds merchant wallet credentials or private keys in options
- Attacker can interpret wallet format (seed phrase/keyfile)
Where this breaks in practice:
- Some merchants use external/hardware wallet addresses, but the official description confirms cleartext storage, so no friction on retrieval
- Blockchain transactions are irreversible, increasing attacker motivation
Detection/coverage: Payment config changes may appear in WordPress audit logs if a security plugin is active; wallet theft is often only noticed after funds move.
STEP 05
Achieve RCE and pivot to database/application tier
With arbitrary file deletion, the attacker typically disables security plugins and deletes core files to trigger WordPress reinstallation under their control. Once code execution is achieved, they can access the MySQL database, steal customer data, and pivot to other services hosted on the same server.
Conditions required:
- Attacker chooses correct file to delete for RCE (e.g., wp-config.php)
- Site not protected by immutable infrastructure or backups
Where this breaks in practice:
- Deleted file may be restored from backup if rapid response, but attacker can move within minutes
- Containerized WordPress without persistence may reduce pivot, but most deployments are traditional LAMP
Detection/coverage: EDR/host agent may detect PHP process spawning shell or unexpected file modifications; WordPress plugin vulnerabilities often slip past traditional WAF.
03 · Compensating Control
1
CRITICAL 9.5→IGNORE 0.0
SEVERITY REDUCEDUninstall or deactivate the CryptoPayment Gateway plugin on every WordPress instance — No patch exists. Removing the plugin is the only complete mitigation. Do this immediately and complete within 3 days under the noisgate mitigation SLA. Re-deploy only after a patched version is available.
2
CRITICAL 9.5→HIGH 8.0
SEVERITY REDUCEDRotate all stored wallet credentials, API keys, and gateway secrets — Assume every merchant wallet exposed by this plugin is compromised. Generate new wallet addresses and move funds; deactivate old API keys. Perform within 24–72 hours, independent of the 90-day remediation window.
3
CRITICAL 9.5→HIGH 7.5
SEVERITY REDUCEDBlock direct requests to
/wp-content/plugins/cryptopayment-gateway/ and suspicious admin-ajax.php calls at the WAF — Apply a temporary WAF rule to deny the plugin path and rate-limit AJAX requests from untrusted sources. This reduces likelihood while the plugin remains installed; deploy within 24 hours.4
CRITICAL 9.5→CRITICAL 9.0
Enable file integrity monitoring and central audit logging on WordPress servers — FIM alerts on deletion of
wp-config.php, .htaccess, or plugin files; SIEM rules watch for unauthorized admin-ajax.php activity. This does not stop exploitation but accelerates response.What doesn't work
- Updating WordPress core or other plugins does not fix this; the vulnerable code is in CryptoPayment Gateway, and no patch exists.
- Disabling directory indexing or hiding the plugin readme does not prevent direct POST requests to the known endpoint.
- A generic WAF without a specific rule may not block path traversal or the plugin's custom AJAX endpoint; test against a sanitized PoC before relying on it.
04 · Intelligence Metadata
The supporting signals.
| In-the-wild status | Active exploitation attempts reported by Defused Cyber via The Hacker News on 2026-11-02; not listed in CISA KEV. |
|---|---|
| Proof of concept | Public PoC: unauthenticated POST to /wp-content/plugins/cryptopayment-gateway/vendor/cryptd/ajax.php per KomodoSec; no named GitHub repo in search results. |
| EPSS score / percentile | 0.00498 (0.498%) — very low predicted exploitation probability; niche plugin limits model signal. |
| KEV status | Not in CISA KEV as of 2026-11. |
| CVSS vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — network, low complexity, no privileges/interaction, scope changed, high CIA → 10.0 base. |
| Affected versions | 1.2.1 through 1.2.2 inclusive. |
| Fixed versions | No fix available as of 2026-09-16; Wordfence lists remediation as 'No known patch'. |
| Scanning/exposure | No GreyNoise/Shodan/Censys mass-scan data returned; exposed surface is limited to WordPress sites running the plugin. |
| Disclosure date | Publicly published 2026-09-10 (Wordfence); NVD published 2026-09-13. |
| Researcher | Pedro Pinho (via Wordfence). |
Sources.
05 · The Call
Final Verdict
= UNCHANGED to CRITICAL (9.5/10)
Why this verdict
- Baseline CRITICAL is fair for affected sites: unauthenticated remote calls with no nonce/capability checks allow arbitrary file deletion and cleartext wallet credential theft.
- Role multiplier: any internet-facing WordPress store running this plugin is a high-value financial target; compromise leads to direct crypto theft and possible RCE into the database tier.
- Friction audit: the only real friction is the plugin's small install base, which limits fleet-wide exposure but does not reduce severity for instances that run it.
- Active exploitation attempts override low EPSS: observed by Defused Cyber in November 2026 with no patch available.
Why not higher?
Not higher than CRITICAL because the blast radius stops at the compromised WordPress host and its attached database/wallet; there is no automatic domain or fleet pivot. The plugin is not a shared infrastructure component like an IdP or hypervisor, so one compromise does not by itself yield fleet control.
Why not lower?
Not lower because exploitation requires no privileges or user interaction, arbitrary file deletion is a known route to RCE, and cleartext wallet key disclosure is immediate financial loss. There is no patch, and active in-the-wild exploitation attempts confirm attackers are using it.
06 · Verification
Crowdsourced verification payload.
Run this on the WordPress web server (or any host with read access to the WordPress root). Example: bash check_cve-2026-81648.sh /var/www/html. Needs read access to wp-content/plugins/cryptopayment-gateway/. Outputs VULNERABLE/PATCHED/UNKNOWN.
#!/usr/bin/env bash
# CVE-2026-81648 checker for CryptoPayment Gateway WordPress plugin
# Run on the WordPress web server with read access to the WordPress root.
# Usage: ./check_cve-2026-81648.sh /var/www/html
set -euo pipefail
WP_ROOT=${1:-/var/www/html}
PLUGIN_DIR=$WP_ROOT/wp-content/plugins/cryptopayment-gateway
if [ ! -d $PLUGIN_DIR ]; then
echo 'PATCHED: plugin directory not found'
exit 1
fi
VERSION=
if [ -f $PLUGIN_DIR/readme.txt ]; then
VERSION=$(grep -m1 -E '^Stable tag:[[:space:]]*[0-9]' $PLUGIN_DIR/readme.txt 2>/dev/null | awk '{print $3}' || true)
fi
if [ -z $VERSION ]; then
MAIN_FILE=$(ls $PLUGIN_DIR/cryptopayment-gateway.php 2>/dev/null || ls $PLUGIN_DIR/*.php 2>/dev/null | head -n1 || true)
if [ -n $MAIN_FILE ] && [ -f $MAIN_FILE ]; then
VERSION=$(grep -m1 -E '^[[:space:]]*Version:[[:space:]]*[0-9]' $MAIN_FILE 2>/dev/null | awk '{print $2}' || true)
fi
fi
if [ -z $VERSION ]; then
echo 'UNKNOWN: plugin directory exists but version could not be determined'
exit 2
fi
if [[ $VERSION == '1.2.1' || $VERSION == '1.2.2' ]]; then
echo 'VULNERABLE: CryptoPayment Gateway version '$VERSION' (affects 1.2.1-1.2.2)'
exit 0
else
echo 'PATCHED: CryptoPayment Gateway version '$VERSION' (not in vulnerable range)'
exit 1
fi