Attackers Attempt to Exploit Unpatched CryptoPayment Gateway WordPress Flaw
Summary
Defused Cyber reports in-the-wild attempts to exploit CVE-2026-81648, an unauthenticated flaw in CryptoPayment Gateway for WordPress that can expose wallet credentials. No fix is available; site owners are advised to remove the plugin and rotate wallet keys.
Key points
- CVE-2026-81648 affects CryptoPayment Gateway WordPress plugin versions 1.2.1 through 1.2.2.
- The flaw lacks an authorization check on an AJAX endpoint, potentially allowing unauthenticated users to delete files, overwrite gateway configuration, and retrieve stored wallet credentials in cleartext.
- Defused Cyber says it observed in-the-wild exploitation attempts; it attributes recorded attacks to infrastructure advertising anonymous, KYC-free VPS hosting.
- No fix is known, and version 1.2.2 is the latest affected version.
- The plugin was removed from the WordPress Plugin Directory on August 28, 2026, over an unspecified security issue.
- Site owners are advised to remove the plugin, rotate wallet keys, and check for suspicious changes.
Article Details
- Vulnerability Types
- Missing authorization check on an AJAX endpoint, allowing unauthenticated administrative operations
- Severity
- CVSS 10.0 (maximum severity)
- Affected Versions
- CryptoPayment Gateway 1.2.1 through 1.2.2
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- unavailable
- Workarounds
- Remove the plugin
- Rotate wallet keys
- Audit for suspicious changes
MITRE ATT&CK
CVE
Products
CryptoPayment GatewayThreat actors are attempting to exploit an unpatched maximum-severity security vulnerability in the CryptoPayment Gateway WordPress plugin, according to findings from Defused Cyber.WordPressThreat actors are attempting to exploit an unpatched maximum-severity security vulnerability in the CryptoPayment Gateway WordPress plugin, according to findings from Defused Cyber.