CVE-2026-81648

10.0 Critique

Publiée le 13/09/2026 à 23:17 · Modifiée le 14/09/2026 à 23:10 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext.

Traduire en français

Produits concernés

Unknown CryptoPayment Gateway

Scores CVSS

Version	Score	Source	Vecteur
3.1	10.0 Critique	contact@wpscan.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-862

Références

https://wpscan.com/vulnerability/9b1490a0-1381-4d22-8086-f75aade4e898/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories