A critical vulnerability in the CryptoPayment Gateway WordPress plugin allows unauthenticated attackers to execute administrative operations, potentially leading to full system compromise.

This vulnerability is caused by a missing authorization check on an AJAX endpoint (CWE-862). It allows unauthenticated attackers to invoke administrative functions, resulting in arbitrary file deletion, configuration overwrites, and the exfiltration of wallet credentials in cleartext.

The potential for unauthorized administrative access poses a catastrophic risk to business operations, as attackers can exfiltrate sensitive financial data and gain persistent control over the server. Given the CVSS score of 10.0, this flaw represents the highest level of severity, and successful exploitation could lead to significant financial loss and permanent damage to customer trust.

Immediate Action: As there is no confirmed patch available at this time, administrators must immediately deactivate and remove the CryptoPayment Gateway plugin from all WordPress installations until a vendor-supplied fix is released.

Proactive Monitoring: Review web server access logs for unusual requests directed toward AJAX endpoints associated with the plugin, specifically looking for unauthorized administrative calls from unknown IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious traffic to plugin-specific AJAX endpoints, although deactivation remains the only guaranteed mitigation.

Public Exploit Available: Unknown.

Due to the critical nature of this vulnerability and the lack of an available patch, immediate removal of the affected software is mandatory. Security teams should prioritize identifying all instances of the CryptoPayment Gateway plugin across their environment and ensure they are disabled until the vendor provides a secure, updated version.