Threat Intelligence

Maximum-Severity Flaw in CryptoPayment Gateway Plugin Is Being Attacked, and There Is No Fix

The Hacker News · 3 Nov 2026

Key Takeaway If your WordPress site uses the CryptoPayment Gateway plugin, remove it now, rotate your wallet keys and check for unexpected changes, because no patch exists.

Threat actors are attempting to exploit CVE-2026-81648, a vulnerability in the CryptoPayment Gateway WordPress plugin that carries the top CVSS score of 10.0. Defused Cyber reported seeing exploitation attempts in the wild, coming from infrastructure that markets itself as "Anonymous KYC-Free VPS Hosting".

The flaw affects versions 1.2.1 to 1.2.2, the latest release. According to the National Vulnerability Database, one of the plugin's AJAX endpoints has no authorization check. This means unauthenticated users can run administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext. WP Scan lists no known fix.

As of August 28, 2026, the plugin has been closed on the WordPress Plugin Directory and can no longer be downloaded, due to an unspecified "security issue". The plugin has been downloaded 1,845 times in total, including 20 times in the last seven days, though it is unclear how many sites actively run it. With no patch available, site owners are advised to remove the plugin, rotate wallet keys and audit their sites for suspicious changes.

WordPress CVE-2026-81648 Plugin Vulnerability Cryptocurrency Unpatched Flaw

Primary source nvd.nist.govOfficial source ↗

Summarised by CISO AI from The Hacker News, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.