Threat actors are exploiting an unpatched maximum-severity security vulnerability in the CryptoPayment Gateway WordPress plugin, as reported by Defused Cyber This article explores vulnerability cryptopayment gateway. . The vulnerability in question is CVE-2026-81648, with a CVSS score of 10.0.
Exploiting this flaw could enable unauthenticated users to delete arbitrary files on the server and extract sensitive data, including wallet credentials.
The CryptoPayment Gateway WordPress plugin, from version 1.2.1 to 1.2.2, fails to apply an authorization check on one of its AJAX endpoints, allowing users to perform administrative operations, including deleting files and overwriting the payment gateway configuration. This flaw is described on the NIST National Vulnerability Database (NVD). The vulnerability impacts versions 1.2.1 through 1.2.2, the latest release.
No patches are available, as per WP Scan.
As of August 28, 2026, the plugin has been removed from the WordPress Plugin Directory and cannot be downloaded due to an undisclosed "security issue." The plugin has been downloaded a total of 1,845 times, including 20 recent installations. Its current presence on WordPress sites remains undisclosed.
"We are tracking in-the-wild exploitation attempts against CVE-2026-81648, a critical vulnerability in the CryptoPayment Gateway for WordPress," Defused Cyber tweeted.
"The attacks we observed originated from infrastructure marketed as 'Anonymous KYC-Free VPS Hosting.' Without a fix, site owners should remove the plugin, rotate wallet keys, and conduct a thorough audit for any suspicious changes."
