Attackers Target Unpatched CryptoPayment Gateway WordPress Plugin Flaw (CVE-2026-81648) Exposing Wallet Credentials

Key facts for TL-2026-5124

Detection coverage for TL-2026-5124

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5124 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CryptoPayment Gateway Unauthenticated AJAX Action Abuse (CVE-2026-81648) - Exploitation (Splunk SPL)

Detects unauthenticated requests to /wp-admin/admin-ajax.php invoking the unprotected CryptoPayment Gateway actions get-settings, save-settings, encryption (encrypt:false) or delete-file described in the WPScan advisory for CVE-2026-81648 (TL-2026-5124). These calls leak wallet credentials in cleartext, overwrite gateway settings or delete arbitrary files; in-the-wild exploitation was reported on 2026-11-03.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1212, T1552
• Data sources: apache_access, nginx_access, modsecurity_waf, iis_w3c
• Severity: critical
• Confidence: high

Splunk SPL

index=web sourcetype IN ("access_combined","apache:access","nginx:plus:access") "/wp-admin/admin-ajax.php" earliest=-24h
```comment CVE-2026-81648 cryptopayment-gateway unauthenticated AJAX actions```
| eval ajax_action=case(match(_raw,"action=get-settings"),"get-settings", match(_raw,"action=save-settings"),"save-settings", match(_raw,"action=encryption"),"encryption", match(_raw,"action=delete-file"),"delete-file")
| where isnotnull(ajax_action)
| eval wp_session=if(match(_raw,"wordpress_logged_in_"),1,0), decrypt_flag=if(match(_raw,"encrypt[=:][ ]*false"),1,0)
| where wp_session=0
| stats count as requests dc(ajax_action) as distinct_actions values(ajax_action) as actions values(status) as http_status max(decrypt_flag) as decrypt_flag min(_time) as first_seen max(_time) as last_seen by src, host
| convert ctime(first_seen) ctime(last_seen)
| sort - requests

Microsoft KQL

let VulnActions = @"action=(get-settings|save-settings|encryption|delete-file)\b";
union isfuzzy=true
    (W3CIISLog
     | where TimeGenerated > ago(24h)
     | where csUriStem =~ "/wp-admin/admin-ajax.php"
     | project TimeGenerated, Src = cIP, Host = sSiteName, Method = csMethod, Status = tostring(scStatus), Request = strcat(csUriStem, "?", csUriQuery)),
    (CommonSecurityLog
     | where TimeGenerated > ago(24h)
     | where RequestURL has "/wp-admin/admin-ajax.php"
     | project TimeGenerated, Src = SourceIP, Host = DestinationHostName, Method = RequestMethod, Status = tostring(EventOutcome), Request = strcat(RequestURL, " ", AdditionalExtensions))
| extend AjaxAction = extract(VulnActions, 1, Request)
| where isnotempty(AjaxAction)
| where Request !has "wordpress_logged_in_"
| extend DecryptFlag = Request matches regex @"encrypt[=:]\s*false"
| summarize Requests = count(), Actions = make_set(AjaxAction), StatusCodes = make_set(Status), DecryptRequested = max(toint(DecryptFlag)), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Src, Host
| order by Requests desc

Sigma

title: CryptoPayment Gateway Unauthenticated AJAX Action Abuse (CVE-2026-81648)
id: 5d1a7c34-2b6e-4f0a-9c58-a1e3b7d90111
status: experimental
description: Detects requests to WordPress admin-ajax.php invoking the unprotected CryptoPayment Gateway actions get-settings, save-settings, encryption or delete-file (CVE-2026-81648, TL-2026-5124).
references:
  - https://nvd.nist.gov/vuln/detail/cve-2026-81648
  - https://wpscan.com/vulnerability/9b1490a0-1381-4d22-8086-f75aade4e898/
  - https://thehackernews.com/2026/11/attackers-target-unpatched.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
  - attack.initial-access
  - attack.t1190
  - attack.credential-access
  - attack.t1212
  - attack.t1552
  - cve.2026-81648
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|endswith: '/wp-admin/admin-ajax.php'
  selection_action:
    cs-uri-query|contains:
      - 'action=get-settings'
      - 'action=save-settings'
      - 'action=encryption'
      - 'action=delete-file'
  condition: selection_path and selection_action
fields:
  - c-ip
  - cs-method
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate administrator using the CryptoPayment Gateway settings page (authenticated session)
  - Authorized vulnerability scanning of the WordPress site
level: critical

Known false positives:

• Legitimate administrator using the plugin settings page from a known admin IP
• Authorized vulnerability scanners or WAF test traffic probing admin-ajax.php

Tuning notes: Access logs rarely contain POST bodies: send the WAF/ModSecurity audit log (or enable body logging for admin-ajax.php) so the action parameter is visible. Log the Cookie header (or a session flag) so the wp_session filter works; otherwise remove it and exclude known admin IPs via a lookup. Enrich src with ASN data to flag 'Anonymous KYC-Free VPS Hosting' ranges reported by Defused Cyber (see SPL-003). Alert immediately on delete-file or decrypt_flag=1; a 200 response to get-settings/encryption from an unauthenticated source means wallet credentials were likely disclosed.

• 🔒 CryptoPayment Gateway Unauthenticated AJAX Action Abuse (CVE-2026-81648) - Exploitation (Microsoft Sentinel KQL) · unlock with TL Creds
• 🔒 Web Process Deleting WordPress Core or CryptoPayment Gateway Files (CVE-2026-81648) - Post-Exploitation (Microsoft Sentinel KQL) · unlock with TL Creds
• 🔒 CryptoPayment Gateway Fingerprinting, KYC-Free VPS Source and Multi-Stage AJAX Chain (CVE-2026-81648) - Recon / Infrastructure / Gateway Tampering (Microsoft Sentinel KQL) · unlock with TL Creds
• 🔒 CryptoPayment Gateway Unauthenticated AJAX Action Abuse (CVE-2026-81648) - Exploitation (Sigma) · unlock with TL Creds
• 🔒 Web Process Deleting WordPress Core or CryptoPayment Gateway Files (CVE-2026-81648) - Post-Exploitation (Sigma) · unlock with TL Creds
• 🔒 CryptoPayment Gateway Fingerprinting, KYC-Free VPS Source and Multi-Stage AJAX Chain (CVE-2026-81648) - Recon / Infrastructure / Gateway Tampering (Sigma) · unlock with TL Creds
• 🔒 Web Process Deleting WordPress Core or CryptoPayment Gateway Files (CVE-2026-81648) - Post-Exploitation (Splunk SPL) · unlock with TL Creds
• 🔒 CryptoPayment Gateway Fingerprinting, KYC-Free VPS Source and Multi-Stage AJAX Chain (CVE-2026-81648) - Recon / Infrastructure / Gateway Tampering (Splunk SPL) · unlock with TL Creds

Indicators of compromise for TL-2026-5124

As of 2026-11-03, Threadlinqs Intelligence tracks 8 indicators of compromise for TL-2026-5124.

How Attackers Target Unpatched CryptoPayment Gateway WordPress works

The CryptoPayment Gateway WordPress plugin (slug: cryptopayment-gateway, author: granwill) in versions 1.2.1 through 1.2.2 does not apply an authorization check on one of its AJAX endpoints. Any unauthenticated visitor can therefore invoke administrative operations by sending HTTP requests to the standard WordPress AJAX handler (/wp-admin/admin-ajax.php). The WPScan advisory (credited to researcher Pedro Pinho) lists the unprotected AJAX actions as get-settings, save-settings, encryption and delete-file.

Impact, per NVD and WPScan: (1) arbitrary file deletion - the delete-file handler concatenates the caller-supplied file name onto a base path with no sanitisation; (2) overwriting of the payment gateway configuration (save-settings), which lets an attacker redirect or tamper with cryptocurrency payment settings; and (3) retrieval of stored wallet credentials in cleartext (get-settings / encryption). The flaw is CWE-862 (Missing Authorization) with CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, score 10.0. Wiz notes NVD SSVC classifies it as automatable and reports an EPSS of roughly 0.5% at disclosure.

The plugin was closed on the WordPress Plugin Directory on 2026-08-28 with the reason 'Security Issue'; 1.2.2 is the latest version and no patched release is known. The Hacker News (2026-11-03) reports that Defused Cyber documented active exploitation attempts originating from infrastructure marketed as 'Anonymous KYC-Free VPS Hosting', and cites 1,845 total downloads (20 in the prior seven days), so the exposed population is small but any affected store holds live wallet credentials. The sources do not name a threat actor, malware family or specific attacker IP addresses, so no actor attribution is made and no network IOCs beyond the hosting marketing description are recorded.

Recommended response per the source: remove the plugin immediately, rotate all wallet keys and credentials, and audit the site for suspicious modifications (unexpected file deletions, altered gateway/payment settings, unauthorized admin-ajax.php requests).

MITRE ATT&CK techniques by tactic:

Initial Access

T1190 Exploit Public-Facing Application

Credential Access

T1212 Exploitation for Credential Access; T1552 Unsecured Credentials

Impact

T1485 Data Destruction; T1565.001 Data Manipulation; T1657 Financial Theft

Resource Development

T1583.003 Acquire Infrastructure

Reconnaissance

T1595.002 Active Scanning

Remediation for Attackers Target Unpatched CryptoPayment Gateway WordPress

Patches

• No fix available: versions 1.2.1-1.2.2 affected; plugin closed on the WordPress Plugin Directory 2026-08-28

Immediate actions

• Deactivate and remove the cryptopayment-gateway plugin from all WordPress sites
• Rotate all cryptocurrency wallet keys and any credentials stored by or exposed through the plugin
• Review web server logs for unauthenticated POST requests to /wp-admin/admin-ajax.php with action values get-settings, save-settings, encryption or delete-file
• Audit payment gateway settings and wallet destination addresses for unauthorized modification

Workarounds

• Remove the plugin directory wp-content/plugins/cryptopayment-gateway/ if it cannot be deactivated
• Block the vulnerable AJAX actions at the WAF or reverse proxy until the plugin is removed

Longer-term hardening

• Audit site files for unexpected deletions and restore from known-good backups
• Replace the plugin with a maintained payment gateway that enforces capability and nonce checks
• Deploy WAF rules blocking unauthenticated calls to the affected AJAX actions

Affected and fixed versions

• granwill — CryptoPayment Gateway (WordPress plugin, slug cryptopayment-gateway)
  Vulnerable versions: 1.2.1; 1.2.2

Timeline of Attackers Target Unpatched CryptoPayment Gateway WordPress

• 2026-08-28 CryptoPayment Gateway (1.2.2 latest) closed on the WordPress Plugin Directory with reason 'Security Issue'
• 2026-09-10 WPScan entry (verified) describes PoC details: unguarded AJAX functions get-settings, save-settings, encryption (called with encrypt:false to decrypt wallet credentials) and delete-file with unsanitized paths; WPScan classifies it as CWE-284 / OWASP A5 Broken Access Control
• 2026-09-10 WPScan published the advisory (credited to locked-ioc-8) documenting unauthenticated AJAX actions get-settings, save-settings, encryption and delete-file; no fix documented
• 2026-09-13 Wiz records NVD SSVC rating of 'automatable', EPSS about 0.5% (percentile 41.4), and no CISA KEV entry at that time
• 2026-09-13 CVE-2026-81648 published in NVD with CVSS 3.1 score 10.0 (CWE-862)
• 2026-10-01 Wiz reports WPScan planned to publish a proof-of-concept on this date; no confirmed in-the-wild exploitation was recorded at disclosure
• 2026-11-03 The Hacker News reports locked-ioc-7 documented in-the-wild exploitation attempts from infrastructure marketed as 'locked-ioc-2'; plugin still unpatched

Sources cited for Attackers Target Unpatched CryptoPayment Gateway WordPress

• NVD - CVE-2026-81648 NVD (NIST) · Advisory · 2026-09-13
• Wiz Vulnerability Database - CVE-2026-81648 Wiz · Advisory · 2026-09-13
• OpenCVE - CVE-2026-81648 app.opencve.io · Advisory · 2026-09-13
• WPScan - CryptoPayment Gateway unauthenticated AJAX actions (Pedro Pinho) wpscan.com · Research · 2026-09-10
• WordPress Plugin Directory - CryptoPayment Gateway (closed 2026-08-28, Security Issue) wordpress.org · Vendor report · 2026-08-28
• Defused Cyber - exploitation attempts post on X (cited by The Hacker News; not independently retrievable) x.com · Research · 2026-11-03
• Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials The Hacker News · News · 2026-11-03

More in vulnerability

• FreeBSoD: LLM-Assisted FreeBSD Kernel Exploit Development Yields Two Jail Escape Chains (CVE-2026-3038)
• PixelSmash – FFmpeg MagicYUV Decoder Heap Out-of-Bounds Write (CVE-2026-8461)
• CVE-2026-58115: Max-severity Node-RED unauthenticated flow-deployment flaw (Siemens SIMATIC IoT2050) exploited to deliver Linux malware
• NCSC CTO Weekly Summary (week ending 2026-09-13): actively exploited Cisco FMC (CVE-2026-20079/20316), PaperCut NG/MF (CVE-2026-81578/82078), MikroTik RouterOS and FortiGate (CVE-2025-25249) flaws; NetScaler SAML bypass (CVE-2026-19490); BlueMoon exploit kit
• iPhone BootROM Flaws (checkm8 CVE-2019-8900, usbliter8) Could Be Used to Undermine Cryptocurrency Wallet Security