Attackers exploit unpatched CryptoPayment Gateway WordPress flaw
Original title: Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials
Defused Cyber observed in-the-wild exploitation of CVE-2026-81648 in the CryptoPayment Gateway plugin, allowing deletion of arbitrary files and extraction of wallet credentials.
An unpatched maximum-severity flaw in the CryptoPayment Gateway WordPress plugin from versions 1.2.1 to 1.2.2 permits unauthenticated users to invoke administrative operations. This includes deleting arbitrary files and recovering stored wallet credentials in cleartext. The plugin has been closed on the WordPress directory and has only 1,845 total downloads. As of August 28, 2026 attempts were recorded from VPS hosting marketed as KYC-free, with attackers using infrastructure for the exploits.
- CVE-2026-81648 CVSS 10.0
- Unauthenticated deletion of files
- Wallet credentials extracted in cleartext
- Plugin closed on WordPress directory
- Only 1,845 downloads recorded
Impact: deletion of arbitrary files and exposure of wallet credentials
| Product | Affected |
|---|---|
| CryptoPayment Gateway | 1.2.1 to 1.2.2 |
| CryptoPayment Gateway | 1.2.1 to 1.2.2 |
- 1.remove the plugin
- 2.rotate wallet keys
- 3.audit for suspicious changes
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-81648 | Unauthenticated Arbitrary File Deletion in CryptoPayment Gateway WordPress Plugin | 10.0 | — |
From the original article
1 min read at thehackernews.com
Threat actors are attempting to exploit an unpatched maximum-severity security vulnerability in the CryptoPayment Gateway WordPress plugin, according to findings from Defused Cyber. The vulnerability in question is CVE-2026-81648, which carries a CVSS score of 10. 0.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.