CryptoPayment Gateway WordPress plugin: missing authorization flaw (CVE-2026-81648) reported exploited, no fix known
Published 05/11/2026 13:38
Timeline
2 events over 3 d 12 h
- 02/11/2026First report+3 d 12 h
- 05/11/2026 13:38Published on WatchtowerPro CISO
In short
The CryptoPayment Gateway WordPress plugin (versions 1.2.1 to 1.2.2) lets anyone on the internet delete files, change payment settings and read stored wallet credentials without logging in. VulnCheck reports exploitation, but CISA has not listed it, and no fix is known. Disable the plugin or block its AJAX file now. Shodan estimates about 989,625 internet-facing WordPress servers worldwide, 183,548 of them in the EU (05/11/2026); how many run an affected version is not yet known.
How bad is it
Critical. An attacker on the internet can delete files, change payment settings and read stored wallet credentials on a site running the vulnerable plugin, without logging in.
Being exploited.
Severity score
CVSS 3.1 from NVD, from wpscan.com, read 05/11/2026.
What an attacker needs
- Internet access to itEnough
- A loginNot needed
- A user to clickNo
- Special settingsNo
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Read the data it holds
- Change or delete that data
- Take it offline
Type: access control bypass.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- CryptoPayment Gateway WordPress plugin (folder name cryptopayment-gateway), versions 1.2.1 to 1.2.2 according to the CVE description. The CVE record's Affected list shows only 1.2.1.
- The flaw is in the plugin, not in WordPress core. One alert feed tagged it as wordpress/wordpress through keyword matching.
What to do now
- No fixed version is known yet. Watch the plugin page, WPScan and NVD for a vendor release and install it as soon as it exists.
- Until then, disable the plugin or block access to /wp-content/plugins/cryptopayment-gateway/vendor/cryptd/ajax.php at the web server. These interim measures reduce exposure and do not make a server safe.
- A WAF signature only buys time. It is not a patch.
- Treat sites that ran version 1.2.1 or 1.2.2 as possibly compromised. Check web logs for POST requests to that path, look for missing files and unexpected changes to the gateway settings, and look for new privileged users and unexpected files.
- Confirm the exact plugin folder name on your site, as several similarly named crypto payment plugins exist.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 5 open questions, followed up as sources answer and all 1 source with their dates. And technology matching: which of your systems run WordPress, at which version, fixed or not - and what each one needs.
Main sources
Known exploited (VulnCheck KEV): CryptoPayment Gateway CryptoPayment Gateway - Missing Authorization Research