Attackers probe unpatched CryptoPayment Gateway plugin flaw
Defused Cyber says exploitation attempts are hitting a maximum-severity bug in the WordPress plugin, which can let unauthenticated users delete files and pull wallet credentials.
Someone is trying to exploit a maximum-severity bug in the CryptoPayment Gateway WordPress plugin, and there's no patch for it. The findings come from Defused Cyber, reported by The Hacker News on Nov 03, 2026.
The flaw is tracked as CVE-2026-81648 and carries a CVSS score of 10.0. According to the report, successful exploitation could let unauthenticated users delete arbitrary files on the server and extract wallet credentials. That combination is the part worth paying attention to: file deletion on a WordPress host is a nuisance, but wallet credentials leaving the box is a different problem.
What the report doesn't give is the affected version range, a timeline for a fix, or any count of sites where attempts have been seen. "Attempting to exploit" is also not the same as "succeeded", and nobody has published a write-up of an intrusion yet.
If you run this plugin, the practical question is whether you can take it off the site until the vendor ships something. Where that isn't possible, check logs for odd requests against the plugin's endpoints and treat any wallet keys stored on that host as exposed.
CVE references
Sources
- Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet CredentialsPrimarythehackernews.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning