# Unpatched CryptoPayment Gateway Vulnerability Exposes Wallet Credentials Critical flaw in WordPress plugin allows unauthenticated attackers to steal sensitive wallet data. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-11-03 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/1ff3c14f-2f2a-484d-a469-33cf537dab65 ## Critical Plugin Vulnerability Identified A maximum-severity security flaw, designated as CVE-2026-81648, has been discovered in the CryptoPayment Gateway WordPress plugin. With a CVSS score of 10.0, this vulnerability allows unauthenticated users to perform administrative operations. The flaw specifically impacts versions 1.2.1 through 1.2.2, posing a significant risk to any site currently running this software. ## Unauthorized Administrative Access Risks The core issue stems from a lack of authorization checks on one of the plugin's AJAX endpoints. This failure permits unauthorized actors to delete arbitrary files on the server and overwrite payment gateway configurations. Most critically, attackers can recover stored wallet credentials in cleartext, leading to potential theft of digital assets. ## Active Exploitation in the Wild Defused Cyber has confirmed active exploitation attempts targeting this specific vulnerability. The observed attacks originated from infrastructure providers that market themselves as anonymous, KYC-free VPS hosting services. This indicates a coordinated effort by threat actors to leverage the unpatched flaw before site administrators can implement necessary security measures or updates. ## Plugin Removal and Availability As of August 28, 2026, the CryptoPayment Gateway plugin has been removed from the official WordPress Plugin Directory. The directory cited an unspecified security issue for this closure. Because the plugin is no longer available for download, users cannot obtain a patched version, leaving existing installations in a highly vulnerable state. ## Limited Scope of Impact Historical data indicates that the plugin has been downloaded 1,845 times in total, with 20 downloads occurring in the final week before its removal. While the total number of active installations remains unclear, the potential for widespread compromise of wallet credentials necessitates immediate action from any site owners who previously utilized this tool. ## Immediate Mitigation Strategies Required Since no official fix currently exists for this vulnerability, site administrators must take immediate defensive steps. Security experts advise the complete removal of the plugin from all WordPress environments. Furthermore, administrators should rotate all wallet keys and conduct a thorough audit of their systems to identify any suspicious changes or unauthorized access. ## Broader Security Operations Context This incident highlights the necessity of closing identity visibility gaps within security operations centers. Organizations must focus on detecting hidden threats across human, machine, and AI identities to prevent similar breaches. Strengthening attack surface visibility is essential for preparing security teams to respond effectively to emerging threats targeting niche plugin vulnerabilities. ## Lessons for Plugin Security The exploitation of CVE-2026-81648 serves as a reminder of the risks associated with third-party WordPress integrations. Relying on unmaintained or insecure code can lead to catastrophic data loss. Moving forward, rigorous security assessments and proactive monitoring are required to ensure that payment-related plugins do not become entry points for malicious actors. ## Sources covering this story - https://thehackernews.com/2026/11/attackers-target-unpatched.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._