Attackers are attempting to exploit a maximum-severity flaw in the CryptoPayment Gateway plugin for WordPress, potentially exposing merchants’ wallet credentials and payment settings. The vulnerability has no listed fix, and the plugin has been removed from the WordPress directory. Site owners using it should act promptly, even though no compromised businesses have been publicly identified.
Key takeaways
- CVE-2026-81648 affects CryptoPayment Gateway versions 1.2.1 to 1.2.2 and is rated 10.0 on the CVSS scale.
- An attacker does not need an account to invoke vulnerable actions, which include changing payment settings and deleting server files.
- Wallet credential retrieval depends on the plugin having been activated at least once.
- No patched version is listed; removing the plugin and reviewing the site are recommended.
Security researchers have reported attempted exploitation, not confirmed theft or successful breaches. For WordPress site owners, this is a timely reminder that plugin checks and prompt incident response are important parts of a reliable WordPress maintenance plan.
What the vulnerability allows
Tracked as CVE-2026-81648, the flaw stems from a missing authorisation check on an AJAX endpoint. The endpoint can let unauthenticated visitors trigger administrative actions, including altering gateway configuration or deleting arbitrary files on the server. If the plugin has previously been activated, the flaw may also expose stored wallet credentials in cleartext.
The affected range is versions 1.2.1 through 1.2.2, with 1.2.2 the latest listed release. The plugin’s WordPress directory listing was closed on 28 August 2026 over a security issue, and no fixed release is listed in the reports.
Exploitation attempts reported, but no confirmed victims
Defused Cyber says it has observed attempts to exploit the flaw. The activity was traced to hosting infrastructure advertised as “Anonymous KYC-Free VPS Hosting”, but researchers have not attributed it to a named threat actor. Their public reporting does not identify a compromised merchant or confirm that funds were stolen.
The plugin’s download history indicates limited uptake, but that does not rule out exposure on individual sites. Site administrators should check their installed plugins rather than assume their website is unaffected because the plugin is no longer available to download.
What WordPress site owners should do
If your site uses CryptoPayment Gateway, remove the plugin while no fix is available. Rotate wallet keys and credentials, then review payment settings, server files and logs for unexpected changes. Because the flaw can delete files, check that clean backups are available before making recovery changes.
A WordPress care plan can help make routine plugin reviews, backups and security checks part of ongoing site upkeep. If you manage updates yourself, include a regular inventory of installed plugins and a process for responding quickly when a plugin is withdrawn or a vulnerability has no patch.