{"id":"EM-20261103-LKFK","url":"https://cyber.eventmonitor.net/incident/EM-20261103-LKFK/vulnerability-cve-2026-81648/","type":"cve","title":"Vulnerability (CVE-2026-81648)","subtitle":"CVE-2026-81648","subject":"CVE-2026-81648","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-03T05:34:37.000Z","firstSignal":"2026-11-02T00:00:00.000Z","lastSignal":"2026-11-03T05:34:37.000Z","updated":"2026-11-06T06:30:49.095Z","revision":2,"life":[{"status":"Born","at":"2026-11-03T05:34:37.000Z","why":"second independent source: C130 The Hacker News"},{"status":"Developing","at":"2026-11-03T05:34:37.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-02T00:00:00.000Z","what":"First signal: C30 VulnCheck KEV"},{"at":"2026-11-03T05:34:37.000Z","what":"Born: second source, C130 The Hacker News. Page EM-20261103-LKFK created."}],"stages":[{"name":"Disclosed","at":"2026-11-02T00:00:00.000Z","detail":"C30 first to name it"},{"name":"Scored","at":"2026-11-02T00:00:00.000Z","detail":"No CVSS yet · EPSS 0.5%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-02T00:00:00.000Z","source":"C30","sourceName":"VulnCheck KEV","role":"Research & News","severity":3,"title":"CVE-2026-81648 known exploited (VulnCheck KEV): Missing Authorization","text":"The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and…","url":"https://vulncheck.com/browse/cve/CVE-2026-81648"},{"at":"2026-11-03T05:34:37.000Z","source":"C130","sourceName":"The Hacker News","role":"Research & News","severity":2,"title":"Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials","text":"Threat actors are attempting to exploit an unpatched maximum-severity security vulnerability in the CryptoPayment Gateway WordPress plugin, according to findings from Defused Cyber. The vulnerability in question is CVE-2026-81648, which carries a CVSS score of 10.0. Successful exploitation of the flaw could permit unauthenticated users to delete arbitrary files on the server and extract","url":"https://thehackernews.com/2026/11/attackers-target-unpatched.html"}],"crowd":[],"reference":{"nvd":null,"kev":null,"epss":{"epss":0.00502,"pct":0.43117,"at":1793803438877},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}