Threats tagged 'ghsa-9r3q-6qw8-8pm7'

CVE-2026-81648 is a critical vulnerability in the CryptoPayment Gateway WordPress plugin versions 1.2.1 through 1.2.2. It involves a missing authorization check on an AJAX endpoint, allowing unauthenticated users to perform administrative actions. These actions include deleting arbitrary files on the server, overwriting payment gateway configurations, and recovering stored wallet credentials in cleartext. The vulnerability has a CVSS score of 10.0, indicating a severe impact on confidentiality, integrity, and availability.