CVE-2026-81648

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-81648 CVE-2026-81648 CryptoPayment Gateway 1.2.2 - Granwill I am @abraxasnull. Loopback lab. The client is CVE-2026-81648-Abraxas-Labs.py. The guard is never called. Direct POST vendor/cryptd/ajax.php, not...

Exploit for CVE-2026-81648

abraxaslabs.tech · github.com/abraxas ·&...

WordPress CryptoPayment Gateway plugin 1.2.1-1.2.2 - Unauthenticated Arbitrary File Deletion and Settings Update vulnerability

Unauthenticated Arbitrary File Deletion and Settings Update vulnerability discovered by Pedro Pinho in WordPress Plugin CryptoPayment Gateway versions 1.2.1-1.2.2...

CVE-2026-81648

The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration an...

EUVD-2026-77085

The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration an...

CVE-2026-81648

The CryptoPayment Gateway WordPress plugin (versions 1.2.1–1.2.2 ) contains a missing authorization check on an AJAX endpoint , allowing unauthenticated users to invoke administrative operations. Attackers can delete arbitrary files on the server, overwrite the payment gateway configuration , and...

CVE-2026-81648 CryptoPayment Gateway 1.2.1 - 1.2.2 - Unauthenticated Arbitrary File Deletion and Settings Update via Unguarded AJAX Router

The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration an...

CVE-2026-81648 CryptoPayment Gateway 1.2.1 - 1.2.2 - Unauthenticated Arbitrary File Deletion and Settings Update via Unguarded AJAX Router

The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration an...

PT-2026-90962

Name of the Vulnerable Software and Affected Versions CryptoPayment Gateway versions 1.2.1 through 1.2.2 Description The plugin fails to apply an authorization check on an AJAX endpoint. This allows unauthenticated users to perform administrative operations, such as deleting arbitrary files on th...

CVE-2026-81648: Missing Authorization

The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration an...