Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials
Threat actors are attempting to exploit an unpatched maximum-severity security vulnerability in the CryptoPayment Gateway WordPress plugin, according to findings from Defused Cyber. The vulnerability in question is CVE-2026-81648, which carries a CVSS score of 10.0. Successful exploitation of the flaw could permit unauthenticated users to delete arbitrary files on the server and extract
Threat actors are currently attempting to exploit a critical vulnerability in the CryptoPayment Gateway WordPress plugin, as reported by Defused Cyber. The flaw, identified as CVE-2026-81648, carries a CVSS score of 10.0, indicating its severe impact. Successful exploitation of this vulnerability could enable unauthenticated users to delete arbitrary files on the server and extract sensitive information, including wallet credentials.
The vulnerability is present in versions 1.2.1 through 1.2.2 of the CryptoPayment Gateway plugin, which was removed from the WordPress Plugin Directory on August 28, 2026. Despite no official patch being available, site owners are advised to remove the affected plugin, update wallet keys, and conduct an audit to identify any suspicious modifications. Recent attacks against this vulnerability originate from anonymous VPS hosting infrastructure.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
