What is CVE-2026-81648?

CVE-2026-81648 is a critical-severity vulnerability in Cryptopayment Gateway, classified under Missing Authorization. CVSS score: 10.0/10. Published 2026-09-13.

How severe is CVE-2026-81648?

Critical severity. CVSS v3 base score is 10.0 out of 10.

Auth bypass in Cryptopayment Gateway

CVE-2026-81648

The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext.

Vulnerability class: Broken Access Control

EPSS: 0.003 (20.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

Affected products

Unknown Cryptopayment Gateway

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

contact@wpscan.com (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2026-81648?: CVE-2026-81648 is a critical-severity vulnerability in Cryptopayment Gateway, classified under Missing Authorization. CVSS score: 10.0/10. Published 2026-09-13.
How severe is CVE-2026-81648?: Critical severity. CVSS v3 base score is 10.0 out of 10.