EUVD-2026-77085
GHSA-9r3q-6qw8-8pm7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running vulnerable plugin
-
DeliverySend crafted request to unprotected AJAX endpoint
-
ExploitInvoke privileged operation without auth
-
ExecutionRead wallet credentials / overwrite config / delete files
-
ImpactRedirect payments and disrupt site
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires that the CryptoPayment Gateway plugin (version 1.2.1 through 1.2.2) be installed and active on a reachable WordPress site; the vulnerable AJAX action must be registered for unauthenticated (nopriv) access, which the advisory confirms by describing unauthenticated invocation. No authentication, no user interaction, and no special configuration are needed beyond having the plugin active (CVSS PR:N/UI:N/AC:L). The primary limiting factor is simply whether this specific, niche plugin is deployed and network-reachable; there is no version- or platform-specific gate beyond the affected 1.2.1-1.2.2 range. |
| Impact | All available signals point to genuine high priority: the CVSS 3.1 vector is fully unauthenticated network exploitation with low complexity and no user interaction (AV:N/AC:L/PR:N/UI:N), scope change (S:C), and high confidentiality, integrity and availability impact, yielding a maximal 10.0. A public write-up/exploit detail from WPScan increases practical exploitability, so this is not a high-CVSS-but-low-real-risk case. It is not on CISA KEV and no active exploitation is confirmed, and EPSS is not provided in the input, so the probability-of-exploitation signal is unavailable rather than reassuring; even a mid-sized operator in malbork should treat this as urgent given the trivial preconditions. The main tempering factor is deployment footprint: this is a niche crypto payment plugin, so the absolute number of exposed sites is likely small, making opportunistic mass scanning plausible but the total blast radius limited. |
| Exploit ScenarioDerived | An attacker discovers a WordPress site running CryptoPayment Gateway 1.2.1-1.2.2 and, without any account, sends a crafted request to the unprotected AJAX action on admin-ajax.php. Using the exposed operations, they read the stored wallet credentials in cleartext, overwrite the gateway configuration to redirect future payments to their own wallet, and delete arbitrary server files to disrupt or cover their tracks. Public exploit detail from WPScan lowers the effort required to reproduce this. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 13, 2026
Missing authorization on an AJAX endpoint in the CryptoPayment Gateway WordPress plugin (versions 1.2.1 through 1.2.2) lets remote unauthenticated attackers invoke administrative operations. An attacker can delete arbitrary files on the server, overwrite the payment gateway configuration, and read stored wallet credentials in cleartext. Publicly available exploit detail exists (reported by WPScan); there is no public evidence of active exploitation at time of analysis, though the CVSS vector (10.0, AV:N/AC:L/PR:N/UI:N/S:C) marks it as trivially exploitable.
RemediationAI
No vendor-released patched version is identified in the available data (1.2.2 is the latest listed and is affected), so the safest immediate action is to deactivate and remove the CryptoPayment Gateway plugin until a fixed release is published; monitor the WPScan advisory (https://wpscan.com/vulnerability/9b1490a0-1381-4d22-8086-f75aade4e898/) for a patched version and upgrade to it as soon as available. As compensating controls while the plugin remains installed, block or restrict public access to the vulnerable AJAX action at the web server or WAF layer (rules targeting the specific admin-ajax.php action name and its nopriv registration), and place the site behind authentication or IP allow-listing for administrative paths - noting this may break legitimate front-end payment callbacks. Because wallet credentials may already be exposed in cleartext, treat any stored wallet keys/credentials as compromised: rotate them and audit for unauthorized configuration changes or deleted files. These controls reduce exposure but do not close the underlying authorization gap.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a WordPress plugin that integrates cryptocurrency payment processing into a site, storing wallet/gateway credentials and exposing an admin-oriented handler over the standard WordPress AJAX mechanism (admin-ajax.php). The root cause is a broken/missing authorization check (CWE-862, Missing Authorization) on one of these AJAX actions: the handler performs privileged operations without verifying the caller's capability or a valid nonce. Because admin-ajax.php endpoints are reachable by any client - including nopriv (unauthenticated) callers when the action is registered for them - the privileged file-management and configuration logic is exposed to the public. The CPE (cpe:2.3:a:unknown:cryptopayment_gateway) reflects that the upstream vendor is not clearly identified in the CPE dictionary.
Know when Cryptopayment Gateway gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated network AJAX call (PR:N/UI:N/AC:L); arbitrary file deletion reaches beyond the plugin's scope (S:C) with full credential, config and file impact (C:H/I:H/A:H).
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
DescriptionCVE.org
The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext.
Articles & Coverage 1
Technical POC Analysis
The advisory identifies a broken access control flaw, classified as CWE-284.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
The CryptoPayment Gateway WordPress plugin (versions 1.2.1-1.2.2) contains a critical authorization bypass that allows unauthenticated remote attackers to delete arbitrary server files, alter payment processor configurations, and steal wallet credentials stored in cleartext. Any organization running this plugin faces immediate risk of payment system compromise, financial data loss, and potential infrastructure damage.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) immediately deactivate and remove the plugin from all affected WordPress installations; (2) deploy Web Application Firewall rules to block HTTP POST requests to the known vulnerable AJAX endpoint paths; (3) restrict WordPress administrative directory access by network IP allowlist where operationally feasible; (4) enable comprehensive WordPress audit logging focused on plugin and configuration file access; (5) implement file integrity monitoring on payment configuration directories and monitor deletion logs; (6) conduct credential audit across all payment processor integrations and reset any API keys or tokens.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB