Attackers are attempting to exploit CVE-2026-81648, a maximum-severity vulnerability in the CryptoPayment Gateway plugin for WordPress, according to findings from Defused Cyber. The flaw has a CVSS score of 10.0 and could allow unauthenticated users to delete server files and retrieve sensitive data, including stored wallet credentials.
The National Vulnerability Database says versions 1.2.1 through 1.2.2 lack an authorization check on an AJAX endpoint. That could let unauthenticated users perform administrative actions, including deleting arbitrary files, changing payment gateway settings and recovering wallet credentials stored in cleartext.
The vulnerability affects versions 1.2.1 and 1.2.2, which is listed as the plugin’s latest version. WP Scan reports that no fix is known. The plugin was removed from the WordPress Plugin Directory on August 28, 2026, due to an unspecified security issue.
Defused Cyber said it has observed exploitation attempts in the wild, originating from infrastructure advertised as “Anonymous KYC-Free VPS Hosting.” The plugin has recorded 1,845 downloads in total, including 20 in the seven days cited in the report; it is unclear whether it remains installed on any WordPress sites.
With no patch available, site owners are advised to remove the plugin, rotate wallet keys and check for suspicious changes.
Sources: The Hacker News.