CVSS 10 Flaw in WordPress Payment Plugin Grants Admin Access

CVE-2026-81648 is a CVSS 10.0 authorization bypass in the CryptoPayment Gateway plugin for WordPress, affecting versions 1.2.1 through 1.2.2. WPScan’s advisory identifies the flaw: one of the plugin’s AJAX endpoints applies no authorization check, so any unauthenticated visitor can invoke functions the plugin reserves for administrators, with no account, session, or credentials of any kind.

CVSS 10.0 for this class of bug is not unusual. No authentication requirement combined with administrative impact in a deployed plugin maps to maximum severity under the CVSS rubric, and in this case that score is not an overstatement.

What the flaw does

WordPress routes AJAX requests through admin-ajax.php. Each handler registers an action name and, optionally, a capability check that verifies whether the calling user is allowed to perform that action. When a plugin registers an action without a capability check, any visitor who knows the endpoint’s action name can trigger it. In a payment plugin, what those administrative actions touch matters: stored gateway API credentials, payment routing configuration, and transaction records are the likely targets. The exact scope of what the exposed endpoint can reach is in the WPScan advisory.

Why payment plugins draw more attention after disclosure

API credentials for payment processors live in or near the plugin’s configuration. Compromise through a missing auth check gives an attacker the same access a site admin has to those credentials, which typically means direct credential theft for use against the payment processor or the ability to modify the payment flow itself. Neither requires much sophistication once the authorization gate is gone.

What to do

Check whether CryptoPayment Gateway is installed. Versions 1.2.1 and 1.2.2 are confirmed affected. Consult the WPScan advisory for current patch status and the fixed version. If an update is not yet available or cannot be applied immediately, deactivate the plugin. Audit payment processor API credentials and any stored transaction access logs for signs of unauthorized use.

Context

WordPress plugin authorization bypasses have come at a steady pace this year. The Events Calendar had two CVSS 9.8 RCE flaws last week, both exploitable without authentication. Elementor Pro was used to backdoor sites through a file-write flaw. Frontend Admin had a CVSS 9.8 auth bypass leading to account takeover. miniOrange SAML had multiple flaws that moved into active exploitation.

The same AJAX authorization miss keeps appearing because WordPress’s action registration API makes it easy to skip the capability check. The nonce is already there, a per-session token that confirms the request came from the site’s own frontend. To a developer who conflates “came from my site” with “user is allowed to do this,” that feels like enough. It is not. The nonce gates replay attacks; the capability check gates privilege. They are not the same gate, and conflating them is a mistake that security review catches immediately and plugin development without review does not. For a niche payment plugin released across two versions, the answer to “who reviewed the authorization model” is probably no one.

CryptoPayment Gateway 1.2.1 and 1.2.2 are the confirmed affected versions. Check the WPScan advisory and update or deactivate.