Critical CryptoPayment Gateway Flaw Exposes Wallet Credentials
Attackers are actively exploiting CVE-2026-81648, a critical vulnerability in the CryptoPayment Gateway WordPress plugin, allowing unauthenticated users to delete arbitrary files and expose sensitive wallet credentials.
Threat actors are actively exploiting a critical vulnerability, tracked as CVE-2026-81648, within the CryptoPayment Gateway WordPress plugin. This flaw, which carries a maximum CVSS score of 10.0, allows unauthenticated attackers to delete arbitrary files on the server, potentially leading to the exposure of sensitive cryptocurrency wallet credentials.
The vulnerability specifically affects versions 1.2.1 through 1.2.2 of the plugin. According to Defused Cyber, the plugin fails to implement proper authorization checks on one of its AJAX endpoints. This oversight enables unauthenticated users to trigger administrative functions, including the deletion of files, overwriting the payment gateway's configuration, and recovering stored wallet credentials in plain text.
Compounding the risk, the CryptoPayment Gateway plugin is no longer available for download from the official WordPress Plugin Directory. It was removed on August 28, 2026, due to an unspecified security issue. While the plugin has seen a modest number of downloads, totaling 1,845, it remains unclear how many WordPress sites are currently running the vulnerable versions.
Defused Cyber has confirmed observing in-the-wild exploitation attempts targeting CVE-2026-81648. The observed attacks originated from infrastructure that advertises itself as "Anonymous KYC-Free VPS Hosting," suggesting a deliberate effort by malicious actors to leverage this vulnerability for financial gain.
Given the lack of an official patch and the active exploitation, site owners using the CryptoPayment Gateway plugin are strongly advised to immediately remove it from their WordPress installations. Furthermore, users should rotate their wallet keys and conduct thorough audits of their systems for any signs of compromise or unauthorized changes.
This incident highlights the persistent risks associated with third-party plugins in content management systems like WordPress. Developers and administrators must remain vigilant in monitoring for vulnerabilities, applying patches promptly, and ensuring that all plugins are regularly audited for security flaws, especially those handling sensitive financial information.