Description

The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-09-13T21:17:01.930Z",
  "pubdate": "2026-09-13T21:17:01.930Z",
  "executiveSummary": "The CryptoPayment Gateway WordPress plugin, specifically versions 1.2.1 through 1.2.2, contains a critical Broken Access Control vulnerability. The flaw originates from the failure to implement mandatory authorization checks on specific AJAX endpoints intended for administrative use.\nThis vulnerability allows unauthenticated remote attackers to invoke restricted administrative functions without requiring valid credentials or elevated privileges. The impact is severe, enabling complete configuration modification, unauthorized disclosure of sensitive wallet credentials stored in cleartext, and arbitrary file deletion on the underlying server.\nThe vulnerability poses a high risk to affected systems as it grants attackers the ability to manipulate payment processing logic and compromise financial data integrity. Exploitation does not require prior authentication, making it trivial for remote adversaries to execute via standard network requests. The potential for arbitrary file deletion also introduces the possibility of a Denial of Service (DoS) or, depending on server configuration, further system-level compromise.",
  "technicalDetails": "The root cause of this vulnerability is the absence of security capability checks or nonce verification within the AJAX handler functions of the CryptoPayment Gateway plugin (versions 1.2.1 to 1.2.2). In WordPress development, AJAX actions must be protected by validating that the requester has sufficient privileges using current_user_can() and verifying security tokens (nonces) to prevent unauthorized invocation.\nBy design, the plugin exposes administrative endpoints accessible via the 'admin-ajax.php' script. Because these specific endpoints fail to perform server-side authorization checks, an unauthenticated user can submit crafted POST or GET requests targeting these specific action hooks. The application processes these requests with the context of an administrator, effectively bypassing standard authentication gates.\nThe attack flow follows a predictable sequence: First, the attacker identifies the registered AJAX actions associated with the CryptoPayment Gateway plugin. Second, the attacker crafts a malicious payload targeting these actions. By sending a request to the WordPress admin-ajax endpoint with the 'action' parameter set to the vulnerable function name, the attacker triggers the administrative logic without authentication. \nThe impact of this unauthorized invocation is multi-faceted. First, the plugin's configuration parameters can be overwritten, allowing an attacker to reroute payment traffic to adversary-controlled wallets. Second, the sensitive wallet credentials, which the plugin stores in cleartext, are returned in the response of the AJAX call, leading to immediate information disclosure. Third, the vulnerability includes functionality that interfaces with the server filesystem; due to the lack of input validation and authorization, attackers can manipulate paths to delete arbitrary files on the web server, potentially disrupting plugin services or leading to deeper system instability.\nThis vulnerability is reachable remotely via the web interface. No interaction from an administrative user is required for successful exploitation, and the exploit payload does not necessitate a complex delivery mechanism, as it relies on standard HTTP requests directed at the WordPress instance. Post-exploitation, an attacker gains full control over the plugin settings and can facilitate exfiltration of sensitive payment data, leading to financial loss and loss of data confidentiality."
}