Attackers exploit unpatched CryptoPayment Gateway plugin flaw to Steal wallet credentials

CVE-2026-81648 is an unpatched flaw carrying a 10.0 CVSS rating, and attackers are actively attempting to exploit it within the CryptoPayment Gateway WordPress plugin.

An unauthenticated user can exploit the flaw to read stored wallet credentials in cleartext, erase arbitrary files on a server, and change the payment gateway’s configuration. No fix or patch for the vulnerability exists.

The flaw affects versions 1.2.1 through 1.2.2, and 1.2.2 remains the latest release available. Defused Cyber reported in-the-wild exploitation attempts, saying the activity “came from infrastructure that markets themselves as ‘Anonymous KYC-Free VPS Hosting.’”

The WordPress Plugin Directory removed the plugin from download on Aug. 28, 2026, after closing it over an undisclosed security issue. Whether the directory’s Aug. 28, 2026 closure connects to CVE-2026-81648 is unknown. No fix or statement has come from the plugin author, the directory provided no reason for closing it, and no count of vulnerable sites exists.

The plugin has 1,845 total downloads, including 20 downloads over the most recent seven days. Whether the plugin is actively run by any WordPress sites is unknown. Closed plugins are not automatically removed by WordPress, so existing installations remain vulnerable.

WPScan assigned CVE-2026-81648 and credited researcher Pedro Pinho, coordinating disclosure on Sept. 13, 2026. The flaw was disclosed in September 2026. The flaw is cataloged as CWE-862 and stems from a missing authorization check on admin-ajax.php, an AJAX endpoint.

The Defused deception network, run by AVES Netsec, documented the first known in-the-wild attempts against a WordPress decoy. Defused made full compromise data available behind a signup wall on its console.

Shops add wallet addresses to settings, then use the CryptoPayment Gateway WooCommerce extension to handle Bitcoin, Bitcoin Cash, Litecoin, Dogecoin, and digital currencies. A limited installed base curbs the immediate blast radius, yet any site with a prior installation of the plugin carries risk until removal.

Deleting files can take a site offline or remove security measures, while overwritten payment configuration can redirect payments, and recovered credentials let an attacker control wallets directly. Such a plugin stores credentials for receiving and moving money; disclosed in plain text, those credentials surrender the wallet, and lost cryptocurrency cannot be recovered. The public record describes exploitation attempts instead of confirmed compromises, and it does not say whether wallet funds were lost at any site.

Attackers use the vulnerability to obtain wallet credentials, delete files, and alter payment settings, which creates risks of theft and transaction manipulation. With wallet credentials, an attacker can move cryptocurrency out of wallets, while altered settings can redirect payments to addresses controlled by attackers.

During checkout, a compromised plugin can capture transaction details or personal information, affecting the customer. Hamer Intelligence Services said the situation shows wider danger when financial tasks move to outside add-ons whose defenses lag the main system.

Cleartext credentials already obtained can still be used later, even after the plugin is removed. If payment settings were altered, including the receiving address, those changes can survive deletion of the plugin.

Removing the extension, rotating wallet keys, and checking for suspicious changes are steps site owners are urged to take. Prasen Shelar said to check the configured wallet address against a known-good backup, watch for unauthorized overwrites, and rotate stored credentials; Defused confirmed the approach. Ondrej Simaisch said no patch exists, version 1.2.2 remains the latest, and file deletion can be triggered even if the plugin was downloaded but never activated.