CVE-2026-81648

Name of the Vulnerable Software and Affected Versions CryptoPayment Gateway versions 1.2.1 through 1.2.2

Description The plugin fails to apply an authorization check on an AJAX endpoint. This allows unauthenticated users to perform administrative operations, such as deleting arbitrary files on the server, overwriting the payment gateway configuration, and recovering stored wallet credentials in cleartext.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.