WordPress CryptoPayment Gateway File Deletion Vulnerability

The CryptoPayment Gateway WordPress plugin, versions 1.2.1 to 1.2.2, has a critical security flaw.

Unauthenticated users can exploit an unprotected AJAX endpoint to perform administrative operations, such as:

• Deleting arbitrary files on the server
• Overwriting the payment gateway configuration
• Recovering stored wallet credentials in cleartext