CVE-2026-81648Disclosure

LOWCVSS 10.0 · CRITICAL

Exploit discussion active in current signal (3 latest mentions)

Immediate actions

  • Prioritize remediation for affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext.

3.5/ 10 priority

Sources & remediation

Weakness type (CWE)
CWE-862

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

  • Public PoC and exploit tooling are both present
  • 10 mentions across 5 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 2 signals
  • PoC mentioned or linked in 3 signals
  • Technical details provided in 4 signals
  • Disclosure: 5 classified signals
  • General: 2 classified signals
  • Peaked 1d ago at 3 mentions (2026-09-21); latest day: 3
  • 10 total mentions across 5 days

Deep dive

Activity timeline10 mentions / 5d
01223Mentions · 2026-09-14: 2Mentions · 2026-09-15: 1Mentions · 2026-09-19: 1Mentions · 2026-09-21: 3Mentions · 2026-09-22: 3PoC Mentioned / Linked · 2026-09-19: 1PoC Mentioned / Linked · 2026-09-21: 1PoC Mentioned / Linked · 2026-09-22: 1Exploit Tool / Code · 2026-09-19: 1Exploit Tool / Code · 2026-09-21: 1Technical Details · 2026-09-14: 1Technical Details · 2026-09-19: 1Technical Details · 2026-09-21: 1Technical Details · 2026-09-22: 109-1409-1509-1909-2109-22
Signal classification4 categories
Disclosure
550.0%
General
220.0%
Exploit
220.0%
PoC
110.0%
Referenced assets5 URLs
Classification over time
DateTotalLabels
2026-09-142
Disclosure1General1
2026-09-151
Disclosure1
2026-09-191
Exploit1
2026-09-213
Disclosure1Exploit1General1
2026-09-223
Disclosure2PoC1
Full discourse10 posts
  • Rıdvan Yağlı@ridvanyagli
    Disclosure

    🔴 WordPress CryptoPayment Gateway eklentisinde kritik güvenlik açığı! CVE-2026-81648 (CVSS 10.0): 1.2.1–1.2.2 sürümlerindeki yetkilendirme eksikliği nedeniyle kimlik doğrulaması olmayan saldırganlar, korumasız AJAX endpoint'i üzerinden sunucudaki keyfi dosyaları silebiliyor, ödeme gateway ayarlarını değiştirebiliyor ve kayıtlı cüzdan bilgilerini açık metin olarak ele geçirebiliyor. https://wpscan.com/vulnerability/9b1490a0-1381-4d22-8086-f75aade4e898/

    Post summary

    The text announces a critical vulnerability (CVE-2026-81648) in the WordPress CryptoPayment Gateway plugin, describing an authorization flaw that enables unauthenticated attackers to delete files, alter settings, and expose wallet credentials.

    00083783
    2.5K followersView on X
  • abraxas@abraxas_null
    Exploit

    we got a biggun'. CVE-2026-81648 - WordPress - CryptoPayment Gateway - Critical 10.0 - Unauthenticated Arbitrary File Deletion exploit: https://github.com/abraxas/CVE-2026-81648 write-up (with infra): https://abraxaslabs.tech/research/cve-2026-81648

    Post summary

    The tweet announces a critical unauthenticated arbitrary file deletion vulnerability in WordPress CryptoPayment Gateway (CVE-2026-81648) with a CVSS score of 10.0 and shares a link to an exploit on GitHub. No patch or evidence of active exploitation is provided.

    11050145
    636 followersView on X
  • ܛܔܔܔܛܔܛܔܛ@skocherhan
    General

    CVE-2026-81648 https://t.co/M09qRsiZRW

    Post summary

    The tweet only mentions CVE-2026-81648 and a shortened URL with no additional context regarding exploitation, patches, PoC, or technical details. Classification is therefore General due to lack of specific indicators.

    01060545
    27.6K followersView on X
  • ExploitGrid@exploitgrid
    Disclosure

    🛡️ #ExploitGrid Daily #Threat Digest Critical Exploits disclosed today: CVE-2025-55182 CVE-2026-81648 CVE-2023-21554 CVE-2024-31218 CVE-2025-39682 ..🧵👇

    Post summary

    The tweet enumerates several CVEs as newly disclosed critical exploits without additional context, PoC, exploit code, patches, or evidence of active exploitation.

    10020112
    403 followersView on X
  • ExploitGrid@exploitgrid
    Disclosure

    💀 Exploits Trending Today ├ CVE-2025-55182 · CVE-2026-81648 · CVE-2023-21554 ├ CVE-2024-31218 · CVE-2025-39682 └ CVE-2026-86555 — ZTE SmartLife hardcoded key 🤦

    Post summary

    The text lists several CVEs and provides a technical detail for one, but does not provide explicit PoC, exploit tooling, active exploitation, or remediation information.

    10000113
    202 followersView on X
  • ExploitGrid@exploitgrid
    PoC

    [EXPLOIT] CVE-2026-81648 [CRITICAL/PoC] CVE-2026-81648 🔗 https://exploitgrid.net/exploits/f2dfc860-dfb3-4934-ada0-c10d2e40c2c7

    Post summary

    The tweet tags the CVE as [CRITICAL/PoC] and links to an exploit page, indicating a proof of concept exists, with no named exploit, patch, or evidence of active exploitation.

    1000045
    203 followersView on X
  • ExploitGrid@exploitgrid
    Disclosure

    🛡️ #ExploitGrid Daily #Threat Digest Critical Exploits disclosed today: CVE-2025-55182 CVE-2026-81648 CVE-2023-21554 CVE-2024-31218 CVE-2025-39682 ..🧵👇

    Post summary

    The tweet is a daily digest announcing five CVEs disclosed today, listing only their identifiers without providing PoC, patches, technical details, or exploitation status.

    1000071
    203 followersView on X
  • ExploitGrid@exploitgrid
    General

    💀 Exploits Trending Today CVE-2025-55182 · CVE-2026-81648 · CVE-2023-21554 CVE-2024-31218 · CVE-2025-39682 CVE-2026-86555 — ZTE SmartLife hardcoded key 🤦

    Post summary

    The text is a minimal listing of trending CVE IDs with only one brief technical hint ('hardcoded key'); it lacks PoC links, exploit tools, patch info, or active-exploitation evidence, so it cannot be confidently classified beyond General.

    1000081
    155 followersView on X
  • ExploitGrid@exploitgrid
    Exploit

    [EXPLOIT] CVE-2026-81648 [CRITICAL/PoC] CVE-2026-81648 🔗 https://exploitgrid.net/exploits/f2dfc860-dfb3-4934-ada0-c10d2e40c2c7

    Post summary

    The tweet announces a critical exploit (CVE-2026-81648) with a linked PoC, emphasizing the availability of functional exploit code.

    1000054
    155 followersView on X
  • Cybersecurity News DE@cybsecuritynews
    Disclosure

    #schwachstellen CVE-2026-81648: WordPress-Plugin FIFU – Erweiterung mit über 60.000 Installationen potenziell betroffen #cve202681648 #featuredimagefromurl #fifu #wordpress https://cybersecurity-news.de/cve-2026-81648-wordpress-plugin-fifu-60000-installationen

    Post summary

    A German-language tweet announcing CVE-2026-81648 in the WordPress FIFU plugin potentially affecting 60,000+ installations, linking to a news article. The post serves as a vulnerability disclosure with no PoC, exploit, patch, or technical details provided in the text itself.

    0000046
    12 followersView on X

Explore more