← Back to blog

Critical Flaw in CryptoPayment Gateway Plugin Under Active Attack

A zero-day vulnerability in a popular WordPress plugin is being exploited to steal wallet credentials. Immediate patching is required to prevent data theft.

TL;DR

  • CVE-2026-81648 is a critical flaw in the CryptoPayment Gateway WordPress plugin.
  • Exploitation allows unauthenticated attackers to delete files and access sensitive data.
  • Threat actors are actively targeting unpatched websites.
  • The vulnerability has a maximum CVSS score of 10.0.
  • Website owners should update immediately or disable the plugin.

Attackers are actively exploiting a critical security flaw in the CryptoPayment Gateway WordPress plugin. The vulnerability, tracked as CVE-2026-81648, allows unauthenticated users to perform destructive actions including file deletion and data extraction.

With a CVSS severity score of 10.0, this flaw poses a significant risk to any website using the affected plugin version. According to security researchers at Defused Cyber, exploitation attempts are already underway, making immediate remediation essential.

Vulnerability Details

  • CVE-2026-81648 affects the CryptoPayment Gateway WordPress plugin.
  • It allows unauthenticated remote attackers to delete arbitrary server files.
  • Successful exploitation can lead to exposure of wallet credentials and other sensitive data.
  • The flaw has been assigned the highest severity rating with a CVSS score of 10.0.

Recommended Actions

  • Immediately update the CryptoPayment Gateway plugin to the latest patched version.
  • If an update isn't possible, disable the plugin until it can be updated.
  • Monitor server logs for suspicious activity related to unauthorized file deletions.
  • Audit user accounts and wallet integrations for signs of compromise.
  • Implement WAF rules to block known attack patterns targeting this vulnerability.

Sources

Sources

Security email updates

One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.