The CryptoPayment Gateway WordPress plugin versions 1.2.1 to 1.2.2 contain a missing authorization check (CWE-862) on an AJAX endpoint. This flaw permits unauthenticated attackers to invoke administrative operations, including deleting arbitrary files, overwriting payment gateway settings, and retrieving wallet credentials in cleartext. The vulnerability has a CVSS 3.1 base score of 10.0, indicating critical severity with network attack vector, no privileges or user interaction required, and complete confidentiality, integrity, and availability impact.

Successful exploitation allows unauthenticated remote attackers to perform administrative functions on the affected WordPress plugin. This includes deleting arbitrary files on the server, which can disrupt service or cause data loss; overwriting payment gateway configurations, potentially redirecting or disrupting payment processing; and recovering stored wallet credentials in cleartext, leading to compromise of sensitive financial information. The vulnerability thus impacts confidentiality, integrity, and availability severely.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected AJAX endpoint if possible and monitor for suspicious activity related to the plugin.