← Back to Vulnerability Reports CVE Intelligence

CVE-2026-81648

See advisory•CRITICAL · CVSS 10•No exploitation reported

What is CVE-2026-81648?

The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext.

CVSS10 NVD 3.1

SeverityCRITICAL

ExploitationNo exploitation reported

EPSS<1% · P43

Triage statusNo Known Exploit

ActionPatch within 48 hours

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWECWE-862

NVD published2026-09-13

NVD last modified2026-09-14

Timeline

2026-09-13Published to the U.S. National Vulnerability Database (NVD)
2026-09-14NVD record last updated

Affected product

See advisory

Remediation Steps

Identify all WordPress installations using the CryptoPayment Gateway plugin
Update the plugin to the latest patched version
Review server logs for signs of unauthorized file deletion or wallet credential access
Restore any critical files from backups if deletion has occurred
Implement Web Application Firewall (WAF) rules to block exploitation attempts during transition

References

Referenced in our briefings & reports

Vulnerability Priority Report – Week 1 of November 2026 (November 2 – 8)

Related vulnerabilities

CVE-2022-0492 – Linux Kernel (same weakness: CWE-862)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.