CVE-2026-81648: CryptoPayment Gateway Flaw Targeted by Attackers
Threat actors are actively attempting to exploit an unpatched maximum-severity vulnerability in the CryptoPayment Gateway WordPress plugin.
·1 min read
According to findings from Defused Cyber, malicious actors are trying to exploit a severe, unpatched security vulnerability affecting the CryptoPayment Gateway plugin for WordPress. The flaw poses an immediate danger to all websites utilizing the gateway.
Quick facts overview: - The vulnerability is tracked under CVE-2026-81648. - It carries a maximum CVSS severity score of 10.0. - Successful exploitation allows unauthenticated users to delete arbitrary files and extract credentials.
Details of the CVE-2026-81648 Flaw Because this vulnerability holds the highest possible severity rating, it requires urgent attention from system administrators. The lack of an immediate patch leaves vulnerable servers exposed to automated and targeted attacks. Exploitation of the bug grants unauthenticated attackers the capability to perform destructive actions on the server infrastructure. This includes deleting arbitrary files and extracting sensitive wallet credentials.
Implications for Website Administrators Administrators running the affected WordPress plugin should take immediate preventive actions to secure their systems. Since an official patch is currently unavailable, temporarily disabling or removing the plugin is the safest mitigation strategy.
Source: The Hacker News
