CryptoPayment Gateway WordPress Plugin Admin Auth Bypass
CryptoPayment Gateway WordPress plugin (1.2.1-1.2.2) skips an AJAX authorization check, allowing unauthenticated admin access to sites running the affected versions. CVSS 10.0.
- Vendor
- CryptoPayment Gateway
- Product
- CryptoPayment Gateway WordPress Plugin (versions 1.2.1 to 1.2.2)
- CVSS
- 10.0
- EPSS (exploit probability)
- 0.5%
- Status
- unpatched
- Published
Is CVE-2026-81648 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-81648 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-13 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.5% (scored November 3, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-81648 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
The CryptoPayment Gateway WordPress plugin in versions 1.2.1 and 1.2.2 fails to check authorization on an AJAX handler, allowing any unauthenticated visitor to invoke functions the plugin reserves for administrators. The vulnerable endpoint is reachable via WordPress’s admin-ajax.php dispatcher without any role or capability verification.
Consult the WPScan advisory for confirmed patch status and the fixed version. Until a patch is applied, deactivating the plugin is the practical mitigation. Payment processor API credentials and transaction logs associated with the affected installation should be audited for unauthorized access.
