Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials Ravie LakshmananNov 03, 2026Cryptocurrency / Cyber Attack Threat actors are attempting to exploit an unpatched maximum-severity security vulnerability in the CryptoPayment Gateway WordPress plugin, according to findings from Defused Cyber. The vulnerability in question is CVE-2026-81648, which carries a CVSS score of 10.0. Successful exploitation of the flaw could permit unauthenticated users to delete arbitrary files on the server and extract sensitive data, including stored wallet credentials. "The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext," according to a description of the flaw on the NIST National Vulnerability Database (NVD). The vulnerability affects versions 1.2.1 through 1.2.2, which is the latest version. There are no known fixes for the flaw, according to WP Scan. As of August 28, 2026, the plugin has been closed on the WordPress Plugin Directory and is no longer available for download due to an unspecified "security issue." Statistics show that the plugin has been collectively downloaded 1,845 times, including 20 downloads over the last seven days. It's unclear if it's actively installed on any WordPress sites. "We are observing in-the-wild exploitation attempts against CVE-2026-81648, a critical (CVSS 10.0) flaw in the CryptoPayment Gateway for WordPress," Defused Cyber said in an X post. "The attacks we recorded came from infrastructure that markets themselves as 'Anonymous KYC-Free VPS Hosting.'" In the absence of a fix, site owners are advised to remove the plugin, rotate wallet keys, and audit for any suspicious changes. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. cryptocurrency, Cyber Attack, Vulnerability, Web Security, WordPress China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers AI-Generated Fake Login Pages Are Making Account Takeovers Easier Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Join the Webinar Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. ROI Calculator: See the Value of IAM Automation Calculate your savings on audits, app onboarding, and discovery. Try it now. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk Your Backup Isn't Ransomware-Proof Just Because It Exists Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security