A critical security vulnerability in the CryptoPayment Gateway WordPress plugin is now attracting attention after security researchers detected attempts to exploit it. The flaw could allow attackers to access sensitive cryptocurrency wallet information without logging into the affected website. According to cybersecurity researchers at Defused Cyber, exploitation attempts have already been observed in the wild, raising concerns for website owners that use the plugin to accept cryptocurrency payments.

The issue is identified as CVE-2026-81648, and it has received the maximum CVSS severity score of 10.0. The vulnerability exists because one of the plugin’s AJAX endpoints does not properly check whether a user has permission to perform administrative actions. As a result, attackers do not need an account or login credentials to send malicious requests and access restricted operations on the affected website.

Successful exploitation could allow attackers to delete arbitrary files from the website’s server, modify payment gateway settings and retrieve stored cryptocurrency wallet credentials in plain text. This creates a serious risk because stolen wallet information could potentially be used to access cryptocurrency funds. Attackers could also alter payment configurations, potentially redirecting transactions to unauthorized wallet addresses.

The vulnerability affects CryptoPayment Gateway plugin versions 1.2.1 and 1.2.2. According to the reports, version 1.2.2 remains the latest release, and no security patch is currently available. The plugin was removed from the official WordPress Plugin Directory on August 28, 2026, following an unspecified security issue. Available statistics indicate that the plugin has recorded 1,845 downloads, although the number of websites currently using it remains unclear.

Defused Cyber has reported observing exploitation attempts against the vulnerability through its security monitoring infrastructure. The researchers also identified that the recorded attacks originated from infrastructure advertised as providing anonymous, KYC-free VPS hosting. These findings indicate that attackers are already attempting to take advantage of the weakness, making it important for website administrators to take immediate precautions.

With no confirmed security update available, website owners are advised to remove the CryptoPayment Gateway plugin from their WordPress installations. They should also rotate their cryptocurrency wallet keys and related credentials, check payment gateway configurations for unauthorized changes and investigate suspicious server activity. Regularly reviewing website files and restoring unexpected changes from trusted backups can also help identify possible compromise.

Editorial verification: The article above retains the reported facts while rewriting the language. The primary reporting is from The Hacker News, supported by CVE records and independent security coverage. The reported exploitation attempts should not be confused with confirmation that every vulnerable installation has been compromised.

Stay alert, and keep your security measures updated!

Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news