Unpatched CVSS 10 CryptoPayment Gateway Flaw Faces Exploitation Attempts

What happened

A maximum-severity flaw (CVSS 10.0) in the CryptoPayment Gateway WordPress plugin is being targeted by exploitation attempts, according to Defused Cyber. Without a login, an attacker can delete server files, extract wallet credentials, and overwrite payment settings. No fix is known.

Why it matters

If exploited, the flaw exposes cryptocurrency wallet credentials, with risk of direct fund loss, and lets attackers change where payments are sent. WordPress stores and billing sites running the plugin are the targets.

What to do

Check today whether any site runs the CryptoPayment Gateway plugin. Consider disabling it until a fix exists, and monitor server files, payment settings, and wallet activity for suspicious changes.

For the technical team

CVE

CVE-2026-81648

Affected

CryptoPayment Gateway (plugin WordPress) · CryptoPayment Gateway plugin for WordPress. Affected versions are not specified in the sources.

Exploitation

Exploitation attempts observed in the wild, reported by Defused Cyber and covered by The Hacker News.

Fix

No known fix, according to the sources.

Vector

CryptoPayment Gateway WordPress plugin. Flaw CVE-2026-81648 lets unauthenticated users delete arbitrary files on the server, extract wallet credentials, and overwrite payment settings. No authentication required.

More details

CVSS 10.0. Finding attributed to Defused Cyber. With no patch, mitigation relies on monitoring and restricting access to the site.

Timeline

1. 11/03/2026 02:38 AM

   First report: Defused Cyber observes exploitation attempts against CVE-2026-81648, still unpatched.

Sources 2 sources

• @TheHackersNews @TheHackersNews
• Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials The Hacker News

See all news