CVE-2026-81648: CryptoPayment Gateway Unauth Wallet Keys - No Patch, Remove It

CVE-2026-81648 is WPScan’s name for missing authorization on a CryptoPayment Gateway WordPress plugin AJAX router. CNA title: Unauthenticated Arbitrary File Deletion and Settings Update via Unguarded AJAX Router. CVE state PUBLISHED. datePublished 2026-09-13T20:06:35.224Z. Record last updated 2026-11-03T15:07:08.414Z.[1]

WPScan (CNA) scores it 10.0 critical (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). CWE is CWE-862 (Missing Authorization). Finder: Pedro Pinho. Coordinator: WPScan. Affected: 1.2.1 through 1.2.2. WPScan’s row says no known fix.[1][2]

wordpress.org still lists the slug cryptopayment-gateway (author granwill). Directory copy this morning: closed as of August 28, 2026, reason Security Issue, not available for download. Meta still shows Version 1.2.2, active installations N/A.[3]

What it is

This is a plugin authorization bug, not WordPress core and not a wallet-protocol flaw.[1]

CNA text, verbatim:

The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext.

That is three capabilities WPScan published, not a lab we ran: delete files, overwrite gateway settings, recover stored wallet material in cleartext. Scope on the 10.0 vector is changed (S:C) - the CNA is scoring impact beyond the WordPress process (wallet keys / files on disk), not a hypervisor breakout.[1]

WPScan’s technical write-up names an unguarded router under the plugin directory. A sibling router in the same tree is described as refusing the same request with a security error. We are not reproducing those URLs or request bodies here. Inventory the slug, then remove the tree. Do not “test” it on a live shop.[2]

How serious

A 10.0 with PR:N, AC:L, UI:N, C:H I:H A:H, S:C is the CNA saying: no login, low complexity, total impact, and they want the score to leave the site process. Treat that as WPScan’s score, not an NVD Coordinator rescore - NVD enrichment on this ID was still thin when we pulled the record.[1]

CISA did not put this on KEV. Catalog version 2026.11.04, 1,768 entries. Newest dateAdded on that dump: 4 Nov Apple (CVE-2024-27834) and 3 Nov WordPress Core (CVE-2026-119977). This CVE is absent. Absence from KEV is not a clean bill of health.[4]

What CISA did attach is ADP Vulnrichment on 3 Nov 2026: SSVC Exploitation: poc, Automatable: yes, Technical Impact: total. That is proof-of-concept, not “active.” Do not read the ADP row as a KEV add.[1]

The Hacker News (3 Nov 2026, page still live 5 Nov) cites Defused Cyber: they are observing in-the-wild exploitation attempts against this CVE, from infrastructure marketed as “Anonymous KYC-Free VPS Hosting.” THN does not claim a confirmed wallet drain. Defused’s IoCs sit behind their own console. We did not pull that list.[5]

Two numbers in circulation, labeled:

THN: plugin downloaded 1,845 times total, 20 in the last seven days, and it is unclear whether any site still has it installed.[5]
wordpress.org: active installations N/A on a closed listing. That is not a census.[3]

Small directory numbers do not make a CVSS 10 safe. One shop with a hot wallet in the plugin settings is enough.

Who is affected

In scope until you prove the directory is gone:

Any WordPress tree with wp-content/plugins/cryptopayment-gateway/, versions 1.2.1 or 1.2.2. The CNA range is those two versions; 1.2.2 is also the version wordpress.org still prints on the closed page.[1][3]
Sites that ever stored wallet addresses or keys in this plugin. Removing the plugin does not rotate a key an attacker already read.[2][5]
WooCommerce shops that used it as a crypto checkout. The CNA product is the plugin, not WooCommerce core.[1]

Out of scope unless a second advisory says otherwise:

Sites with no cryptopayment-gateway directory. Other crypto-payment plugins are not this CVE.
WordPress core. The 7.1.4 upgrade-window race (CVE-2026-119977, KEV 3 Nov, due 6 Nov) is a different bug. Patch core anyway; it does not remove this plugin.[4]

Unsupported / no-floor note: there is no patched version on the CNA row. “Update it” is not a remediation.[1][2]

What to do now

Inventory the slug. Do not trust a dashboard that only lists active plugins.

# one site
wp plugin list --name=cryptopayment-gateway --fields=name,status,version --path=/home/USER/public_html

# cPanel box, every account (read-only)
find /home -path '*/wp-content/plugins/cryptopayment-gateway' -type d 2>/dev/null

If the directory exists: deactivate, delete, then confirm it is gone. There is no vendor floor.

wp plugin deactivate cryptopayment-gateway --path=/home/USER/public_html
wp plugin delete cryptopayment-gateway --path=/home/USER/public_html
test ! -d /home/USER/public_html/wp-content/plugins/cryptopayment-gateway && echo gone

If WP-CLI is missing, rename the directory out of plugins/ and remove it after you have a backup. Deactivate is not enough if files still sit on disk.

Treat stored wallet material as burned. Compare the last known-good wallet addresses and callback URLs against whatever the plugin still had in the database. Rotate every key, seed, API token, and destination address that plugin ever held. Move funds if the on-chain address was the one in settings. Removing the plugin does not un-steal a key.[5]
Look for the published impact classes, not a single IoC file. WPScan’s impact list is file deletion, settings overwrite, and cleartext credential recovery.[1][2]

# tree still present?
ls -ld /home/USER/public_html/wp-content/plugins/cryptopayment-gateway

# installer kicked because wp-config.php vanished (one published consequence)
test -f /home/USER/public_html/wp-config.php || echo 'wp-config missing'

# access log: POSTs under the plugin path (path is the plugin slug, not a payload)
grep -F 'cryptopayment-gateway' /usr/local/apache/domlogs/* 2>/dev/null | grep -i POST | tail

A missing wp-config.php plus a redirect to /wp-admin/setup-config.php is a site-takeover pattern WPScan described. Restore from a known-good backup; do not complete that installer.[2]

Do not reinstall from a zip you still have. wordpress.org closed the listing for a security issue. 1.2.2 is the latest and the affected version.[2][3]

Compromise signs

None of these prove CVE-2026-81648 by themselves. Together they are enough to restore and rotate.

Plugin directory present after you thought it was unused.
Wallet address or callback URL in the shop no longer matches your records.
wp-config.php or .htaccess missing; WordPress offering the installer.
Unexpected admin users, new PHP files under uploads, or POSTs to cryptopayment-gateway from hosts you do not recognize.

FAQ

Is this on CISA KEV? No. Catalog 2026.11.04 (1,768 entries) does not list CVE-2026-81648. The 3 Nov KEV add is WordPress core CVE-2026-119977. CISA’s ADP row on this ID is SSVC poc, not KEV.[1][4]

Did attackers actually steal wallets? Defused, via THN, reported attempts. Public write-ups we used do not document a confirmed drain. Assume keys are burned anyway if the plugin was ever configured.[5]

Is deactivate enough? No. The CNA impact includes arbitrary file deletion against the plugin’s on-disk router. Delete the directory. Then rotate keys.[1][2]

Small download count - skip it? THN’s 1,845 figure is a directory statistic, not your fleet. find the slug. One hit is in-scope.[5]

Does WordPress 7.1.4 fix this? No. 7.1.4 is the core upgrade-window race. This is a closed plugin with no patched release.[3][4]

Sources

CVE-2026-81648 / CVE JSON - WPScan CNA, CVSS 10.0, CWE-862, 1.2.1-1.2.2, Pedro Pinho; CISA-ADP SSVC poc / automatable / total, updated 2026-11-03T15:07:08.414Z
WPScan 9b1490a0 - unauth file deletion, settings overwrite, cleartext wallet recovery; no known fix
wordpress.org/plugins/cryptopayment-gateway - closed 28 Aug 2026, reason Security Issue; version 1.2.2; author granwill
CISA KEV JSON - catalogVersion 2026.11.04, count 1768; this CVE absent
The Hacker News, 3 Nov 2026 - Defused in-the-wild attempts; 1,845 downloads; remove plugin and rotate keys