Unpatched CryptoPayment Gateway Vulnerability Exposes Wallet Credentials
Critical flaw in WordPress plugin allows unauthenticated attackers to steal sensitive wallet data.
1Critical Plugin Vulnerability Identified
A maximum-severity security flaw, designated as CVE-2026-81648, has been discovered in the CryptoPayment Gateway WordPress plugin. With a CVSS score of 10.0, this vulnerability allows unauthenticated users to perform administrative operations. The flaw specifically impacts versions 1.2.1 through 1.2.2, posing a significant risk to any site currently running this software.
2Unauthorized Administrative Access Risks
The core issue stems from a lack of authorization checks on one of the plugin's AJAX endpoints. This failure permits unauthorized actors to delete arbitrary files on the server and overwrite payment gateway configurations. Most critically, attackers can recover stored wallet credentials in cleartext, leading to potential theft of digital assets.
3Active Exploitation in the Wild
Defused Cyber has confirmed active exploitation attempts targeting this specific vulnerability. The observed attacks originated from infrastructure providers that market themselves as anonymous, KYC-free VPS hosting services. This indicates a coordinated effort by threat actors to leverage the unpatched flaw before site administrators can implement necessary security measures or updates.
4Plugin Removal and Availability
As of August 28, 2026, the CryptoPayment Gateway plugin has been removed from the official WordPress Plugin Directory. The directory cited an unspecified security issue for this closure. Because the plugin is no longer available for download, users cannot obtain a patched version, leaving existing installations in a highly vulnerable state.
5Limited Scope of Impact
Historical data indicates that the plugin has been downloaded 1,845 times in total, with 20 downloads occurring in the final week before its removal. While the total number of active installations remains unclear, the potential for widespread compromise of wallet credentials necessitates immediate action from any site owners who previously utilized this tool.
6Immediate Mitigation Strategies Required
Since no official fix currently exists for this vulnerability, site administrators must take immediate defensive steps. Security experts advise the complete removal of the plugin from all WordPress environments. Furthermore, administrators should rotate all wallet keys and conduct a thorough audit of their systems to identify any suspicious changes or unauthorized access.
7Broader Security Operations Context
This incident highlights the necessity of closing identity visibility gaps within security operations centers. Organizations must focus on detecting hidden threats across human, machine, and AI identities to prevent similar breaches. Strengthening attack surface visibility is essential for preparing security teams to respond effectively to emerging threats targeting niche plugin vulnerabilities.
8Lessons for Plugin Security
The exploitation of CVE-2026-81648 serves as a reminder of the risks associated with third-party WordPress integrations. Relying on unmaintained or insecure code can lead to catastrophic data loss. Moving forward, rigorous security assessments and proactive monitoring are required to ensure that payment-related plugins do not become entry points for malicious actors.