# Attackers Target Unpatched CryptoPayment Gateway WordPress Plugin Flaw (CVE-2026-81648) Exposing Wallet Credentials

> CVE-2026-81648 is a missing-authorization flaw on an AJAX endpoint in the CryptoPayment Gateway WordPress plugin (1.2.1-1.2.2) that lets unauthenticated users delete arbitrary server files, overwrite payment gateway settings and recover wallet credentials in cleartext. Defused Cyber reported in-the-wild exploitation attempts from infrastructure advertised as 'Anonymous KYC-Free VPS Hosting'; no fix exists and the plugin was closed on the WordPress Plugin Directory on 2026-08-28.

- **Published:** 2026-11-03T06:01:18Z
- **Last reviewed:** 2026-11-03T06:01:18Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5124
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5124.png
- **ID:** TL-2026-5124
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 8
- **CVEs:** CVE-2026-81648

## Description

The CryptoPayment Gateway WordPress plugin (slug: cryptopayment-gateway, author: granwill) in versions 1.2.1 through 1.2.2 does not apply an authorization check on one of its AJAX endpoints. Any unauthenticated visitor can therefore invoke administrative operations by sending HTTP requests to the standard WordPress AJAX handler (/wp-admin/admin-ajax.php). The WPScan advisory (credited to researcher Pedro Pinho) lists the unprotected AJAX actions as get-settings, save-settings, encryption and delete-file.

Impact, per NVD and WPScan: (1) arbitrary file deletion - the delete-file handler concatenates the caller-supplied file name onto a base path with no sanitisation; (2) overwriting of the payment gateway configuration (save-settings), which lets an attacker redirect or tamper with cryptocurrency payment settings; and (3) retrieval of stored wallet credentials in cleartext (get-settings / encryption). The flaw is CWE-862 (Missing Authorization) with CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, score 10.0. Wiz notes NVD SSVC classifies it as automatable and reports an EPSS of roughly 0.5% at disclosure.

The plugin was closed on the WordPress Plugin Directory on 2026-08-28 with the reason 'Security Issue'; 1.2.2 is the latest version and no patched release is known. The Hacker News (2026-11-03) reports that Defused Cyber documented active exploitation attempts originating from infrastructure marketed as 'Anonymous KYC-Free VPS Hosting', and cites 1,845 total downloads (20 in the prior seven days), so the exposed population is small but any affected store holds live wallet credentials. The sources do not name a threat actor, malware family or specific attacker IP addresses, so no actor attribution is made and no network IOCs beyond the hosting marketing description are recorded.

Recommended response per the source: remove the plugin immediately, rotate all wallet keys and credentials, and audit the site for suspicious modifications (unexpected file deletions, altered gateway/payment settings, unauthorized admin-ajax.php requests).

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1583.003 Virtual Private Server
- T1190 Exploit Public-Facing Application
- T1212 Exploitation for Credential Access
- T1552 Unsecured Credentials
- T1485 Data Destruction
- T1565.001 Stored Data Manipulation
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CryptoPayment Gateway Unauthenticated AJAX Action Abuse (CVE-2026-81648) - Exploitation (Splunk SPL)** (`TL-2026-5124-SPL-001`)

Detects unauthenticated requests to /wp-admin/admin-ajax.php invoking the unprotected CryptoPayment Gateway actions get-settings, save-settings, encryption (encrypt:false) or delete-file described in the WPScan advisory for CVE-2026-81648 (TL-2026-5124). These calls leak wallet credentials in cleartext, overwrite gateway settings or delete arbitrary files; in-the-wild exploitation was reported on 2026-11-03.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1212, T1552
- **Data sources:** apache_access, nginx_access, modsecurity_waf, iis_w3c
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

````spl
index=web sourcetype IN ("access_combined","apache:access","nginx:plus:access") "/wp-admin/admin-ajax.php" earliest=-24h
```comment CVE-2026-81648 cryptopayment-gateway unauthenticated AJAX actions```
| eval ajax_action=case(match(_raw,"action=get-settings"),"get-settings", match(_raw,"action=save-settings"),"save-settings", match(_raw,"action=encryption"),"encryption", match(_raw,"action=delete-file"),"delete-file")
| where isnotnull(ajax_action)
| eval wp_session=if(match(_raw,"wordpress_logged_in_"),1,0), decrypt_flag=if(match(_raw,"encrypt[=:][ ]*false"),1,0)
| where wp_session=0
| stats count as requests dc(ajax_action) as distinct_actions values(ajax_action) as actions values(status) as http_status max(decrypt_flag) as decrypt_flag min(_time) as first_seen max(_time) as last_seen by src, host
| convert ctime(first_seen) ctime(last_seen)
| sort - requests
````

### Microsoft KQL

```kql
let VulnActions = @"action=(get-settings|save-settings|encryption|delete-file)\b";
union isfuzzy=true
    (W3CIISLog
     | where TimeGenerated > ago(24h)
     | where csUriStem =~ "/wp-admin/admin-ajax.php"
     | project TimeGenerated, Src = cIP, Host = sSiteName, Method = csMethod, Status = tostring(scStatus), Request = strcat(csUriStem, "?", csUriQuery)),
    (CommonSecurityLog
     | where TimeGenerated > ago(24h)
     | where RequestURL has "/wp-admin/admin-ajax.php"
     | project TimeGenerated, Src = SourceIP, Host = DestinationHostName, Method = RequestMethod, Status = tostring(EventOutcome), Request = strcat(RequestURL, " ", AdditionalExtensions))
| extend AjaxAction = extract(VulnActions, 1, Request)
| where isnotempty(AjaxAction)
| where Request !has "wordpress_logged_in_"
| extend DecryptFlag = Request matches regex @"encrypt[=:]\s*false"
| summarize Requests = count(), Actions = make_set(AjaxAction), StatusCodes = make_set(Status), DecryptRequested = max(toint(DecryptFlag)), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Src, Host
| order by Requests desc
```

### Sigma

```yaml
title: CryptoPayment Gateway Unauthenticated AJAX Action Abuse (CVE-2026-81648)
id: 5d1a7c34-2b6e-4f0a-9c58-a1e3b7d90111
status: experimental
description: Detects requests to WordPress admin-ajax.php invoking the unprotected CryptoPayment Gateway actions get-settings, save-settings, encryption or delete-file (CVE-2026-81648, TL-2026-5124).
references:
  - https://nvd.nist.gov/vuln/detail/cve-2026-81648
  - https://wpscan.com/vulnerability/9b1490a0-1381-4d22-8086-f75aade4e898/
  - https://thehackernews.com/2026/11/attackers-target-unpatched.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
  - attack.initial-access
  - attack.t1190
  - attack.credential-access
  - attack.t1212
  - attack.t1552
  - cve.2026-81648
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|endswith: '/wp-admin/admin-ajax.php'
  selection_action:
    cs-uri-query|contains:
      - 'action=get-settings'
      - 'action=save-settings'
      - 'action=encryption'
      - 'action=delete-file'
  condition: selection_path and selection_action
fields:
  - c-ip
  - cs-method
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate administrator using the CryptoPayment Gateway settings page (authenticated session)
  - Authorized vulnerability scanning of the WordPress site
level: critical

```

**Known false positives:**

- Legitimate administrator using the plugin settings page from a known admin IP
- Authorized vulnerability scanners or WAF test traffic probing admin-ajax.php

**Tuning notes:** Access logs rarely contain POST bodies: send the WAF/ModSecurity audit log (or enable body logging for admin-ajax.php) so the action parameter is visible. Log the Cookie header (or a session flag) so the wp_session filter works; otherwise remove it and exclude known admin IPs via a lookup. Enrich src with ASN data to flag 'Anonymous KYC-Free VPS Hosting' ranges reported by Defused Cyber (see SPL-003). Alert immediately on delete-file or decrypt_flag=1; a 200 response to get-settings/encryption from an unauthenticated source means wallet credentials were likely disclosed.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CryptoPayment Gateway Unauthenticated AJAX Action Abuse (CVE-2026-81648) - Exploitation (Microsoft Sentinel KQL) (locked: unlock with TL Creds)
- Web Process Deleting WordPress Core or CryptoPayment Gateway Files (CVE-2026-81648) - Post-Exploitation (Microsoft Sentinel KQL) (locked: unlock with TL Creds)
- CryptoPayment Gateway Fingerprinting, KYC-Free VPS Source and Multi-Stage AJAX Chain (CVE-2026-81648) - Recon / Infrastructure / Gateway Tampering (Microsoft Sentinel KQL) (locked: unlock with TL Creds)
- CryptoPayment Gateway Unauthenticated AJAX Action Abuse (CVE-2026-81648) - Exploitation (Sigma) (locked: unlock with TL Creds)
- Web Process Deleting WordPress Core or CryptoPayment Gateway Files (CVE-2026-81648) - Post-Exploitation (Sigma) (locked: unlock with TL Creds)
- CryptoPayment Gateway Fingerprinting, KYC-Free VPS Source and Multi-Stage AJAX Chain (CVE-2026-81648) - Recon / Infrastructure / Gateway Tampering (Sigma) (locked: unlock with TL Creds)
- Web Process Deleting WordPress Core or CryptoPayment Gateway Files (CVE-2026-81648) - Post-Exploitation (Splunk SPL) (locked: unlock with TL Creds)
- CryptoPayment Gateway Fingerprinting, KYC-Free VPS Source and Multi-Stage AJAX Chain (CVE-2026-81648) - Recon / Infrastructure / Gateway Tampering (Splunk SPL) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials](https://thehackernews.com/2026/11/attackers-target-unpatched.html)
- [NVD - CVE-2026-81648](https://nvd.nist.gov/vuln/detail/cve-2026-81648)
- [WPScan - CryptoPayment Gateway unauthenticated AJAX actions (Pedro Pinho)](https://wpscan.com/vulnerability/9b1490a0-1381-4d22-8086-f75aade4e898/)
- [WordPress Plugin Directory - CryptoPayment Gateway (closed 2026-08-28, Security Issue)](https://wordpress.org/plugins/cryptopayment-gateway/)
- [Wiz Vulnerability Database - CVE-2026-81648](https://www.wiz.io/vulnerability-database/cve/cve-2026-81648)
- [OpenCVE - CVE-2026-81648](https://app.opencve.io/cve/CVE-2026-81648)
- [Defused Cyber - exploitation attempts post on X (cited by The Hacker News; not independently retrievable)](https://x.com/DefusedCyber/status/2117325160608870613)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5124