CVE-2026-8164810.0Critical
CryptoPayment Gateway 1.2.1 - 1.2.2 - Unauthenticated Arbitrary File Deletion and Settings Update via Unguarded AJAX Router
Vendor not yet named
Not in CISA KEV
0.5%probability of exploitation in the next 30 days
42nd percentile
050100
Higher than 42% of scored CVEs
10.0CriticalCVSS
LowMediumHighCrit.
DescriptionNVD
The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext.
Coverage1 article · 1 outlet
First in our coverage: The Hacker News, 3 Nov.
- Attackers Exploit CryptoPayment Gateway Flaw to Steal Wallet KeysThe Hacker News · first in our coverage
New articles also arrive in the RSS feed.