{
  "id": 17915200,
  "title": "Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials",
  "url": "https://urgent.news/2026/11/03/attackers-target-unpatched-cryptopayment-gateway-flaw-that-can-expose",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-03T05:34:37.000Z",
  "source": {
    "name": "The Hacker News",
    "slug": "the-hacker-news",
    "url": "https://thehackernews.com/2026/11/attackers-target-unpatched.html"
  },
  "original_language": "en",
  "account": "Threat actors are currently attempting to exploit a critical vulnerability in the CryptoPayment Gateway WordPress plugin, as reported by Defused Cyber. The flaw, identified as CVE-2026-81648, carries a CVSS score of 10.0, indicating its severe impact. Successful exploitation of this vulnerability could enable unauthenticated users to delete arbitrary files on the server and extract sensitive information, including wallet credentials. The vulnerability is present in versions 1.2.1 through 1.2.2 of the CryptoPayment Gateway plugin, which was removed from the WordPress Plugin Directory on August 28, 2026. Despite no official patch being available, site owners are advised to remove the affected plugin, update wallet keys, and conduct an audit to identify any suspicious modifications. Recent attacks against this vulnerability originate from anonymous VPS hosting infrastructure.",
  "summary": "Threat actors are attempting to exploit an unpatched maximum-severity security vulnerability in the CryptoPayment Gateway WordPress plugin, according to findings from Defused Cyber. The vulnerability in question is CVE-2026-81648, which carries a CVSS score of 10.0. Successful exploitation of the flaw could permit unauthenticated users to delete arbitrary files on the server and extract",
  "key_points": [
    "Critical vulnerability CVE-2026-81648 in CryptoPayment Gateway plugin",
    "Exploitation could delete files, expose wallet credentials",
    "Removed from WordPress Directory on August 28, 2026"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}