KROMSE explanation

CryptoPayment Gateway has a security flaw (CVE-2026-81648, CVSS 10). The official record says: The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and…

Not confirmed yet, but attack code is public, so attacks often follow within days.

Anyone running CryptoPayment Gateway.

• Install the maker's update for CryptoPayment Gateway as soon as it is out.
• Not sure if you use it? KROMSE can check your product for free.