Attackers Target Unpatched Crypto Payment Gateway Flaw That Can Expose Wallet Credentials

Summary: Threat actors are attempting to exploit CVE-2026-81648, a maximum-severity (CVSS 10.0) unpatched flaw in the CryptoPayment Gateway WordPress plugin, according to Defused Cyber. The flaw in versions 1.2.1 through 1.2.2 lets unauthenticated users invoke administrative operations through an AJAX endpoint lacking an authorization check, including deleting arbitrary files, overwriting the payment gateway configuration, and recovering stored wallet credentials in cleartext.
What's compelling: There is no fix: the plugin has been closed on the WordPress Plugin Directory as of August 28, 2026, and the recorded exploitation attempts came from infrastructure marketing itself as 'Anonymous KYC-Free VPS Hosting' - so any site still running it is exposed to wallet credential theft with no patch path.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-81648
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026