CryptoPayment Gateway WordPress plugin: unauthenticated arbitrary file deletion and wallet credential theft (CVE-2026-81648)
Severity: critical · Patch status: unpatched · Since 2026-11-03 · CVE-2026-81648
Defused Cyber reports in-the-wild exploitation attempts against CVE-2026-81648, a CVSS 10.0 flaw in the CryptoPayment Gateway WordPress plugin affecting versions 1.2.1 through 1.2.2 (the latest). The plugin's AJAX endpoint lacks an authorization check, letting unauthenticated attackers invoke administrative operations: delete arbitrary files on the server, overwrite payment gateway configuration, and recover stored wallet credentials in cleartext. No patch exists; the plugin was closed on the WordPress Plugin Directory on August 28, 2026 due to an unspecified security issue, with 1,845 total downloads. Recorded attacks originated from infrastructure marketed as 'Anonymous KYC-Free VPS Hosting.' Site owners should remove the plugin, rotate wallet keys, and audit for suspicious changes.
What to do
- Remove the CryptoPayment Gateway plugin from all WordPress sites immediately
- Rotate any cryptocurrency wallet keys or credentials that may have been stored via the plugin
- Audit the server for deleted files, modified gateway configuration, and other signs of compromise
- Check logs for requests to the affected AJAX endpoint from unknown sources
- Review whether any funds or wallet access were abused; treat credentials as compromised
Sources
All live incidents on Threat Watch
