Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials

Threat actors are actively attempting to exploit an unpatched maximum-severity security vulnerability in the CryptoPayment Gateway WordPress plugin, according to findings from Defused Cyber. The vulnerability, CVE-2026-81648, carries a CVSS score of 10.0 and could allow unauthenticated users to delete arbitrary files on the server and extract sensitive data, including stored wallet credentials.

Vulnerability Details

The flaw affects versions 1.2.1 through 1.2.2 of the plugin, which is the latest version. According to the NIST National Vulnerability Database, the plugin does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting files and recovering stored wallet credentials in cleartext.

Active Exploitation

As of August 28, 2026, the plugin has been closed on the WordPress Plugin Directory and is no longer available for download due to an unspecified "security issue." Statistics show the plugin has been collectively downloaded 1,845 times, including 20 downloads over the last seven days. It remains unclear if it's actively installed on any WordPress sites.

Defused Cyber reported observing in-the-wild exploitation attempts against the vulnerability, with attacks coming from infrastructure that markets themselves as 'Anonymous KYC-Free VPS Hosting.'

Mitigation Advice

In the absence of a fix, site owners are advised to remove the plugin, rotate wallet keys, and audit for any suspicious changes. The vulnerability represents a significant risk to cryptocurrency-related websites using this payment gateway solution.