Active attacks target critical CryptoPayment WordPress vulnerability
Unpatched WordPress payment plugin flaw is under attack
Threat actors are attempting to exploit CVE-2026-81648, a maximum-severity vulnerability in the CryptoPayment Gateway WordPress plugin. Defused Cyber reported exploitation attempts against the issue, which has a CVSS score of 10.0 and affects versions 1.2.1 through 1.2.2, including the latest release.
The flaw can allow unauthenticated users to delete arbitrary files on a server and access sensitive information, including stored wallet credentials. For sites using the plugin to process cryptocurrency payments, the exposure combines a web-application compromise risk with possible loss of control over payment-related secrets.
The National Vulnerability Database describes the issue as a missing authorization check on one of the plugin's AJAX endpoints. That weakness permits unauthenticated users to invoke administrative operations rather than being restricted to normal visitor-level actions.
Administrative actions may expose credentials
The affected endpoint can be used to delete arbitrary files, overwrite the payment gateway configuration and recover stored wallet credentials in cleartext. Those capabilities make the vulnerability more consequential than a routine plugin defect: an attacker may be able to alter the operation of the gateway while also extracting credentials held by the site.
Defused Cyber said it observed exploitation attempts in the wild. The attacks recorded by the company originated from infrastructure that markets itself as “Anonymous KYC-Free VPS Hosting.” The report does not establish how many websites have been compromised, but it confirms that attackers are trying to use the vulnerability.
CryptoPayment Gateway was closed in the WordPress Plugin Directory on August 28, 2026, because of an unspecified security issue and is no longer available for download. The plugin had been downloaded 1,845 times in total, including 20 downloads in the prior seven days. It is unclear whether it remains actively installed on WordPress sites.
No fix is currently listed
WPScan reports no known fix for CVE-2026-81648. With versions 1.2.1 and 1.2.2 both affected and no patched release identified, upgrading within the existing published version range does not remove the exposure.
Site owners are advised to remove the plugin, rotate wallet keys and audit systems for suspicious changes. The practical business implication is to treat any deployment of CryptoPayment Gateway as an urgent incident-response priority: remove the component, replace exposed credentials and verify whether payment configuration or server files were altered.