604/69 Wednesday, November 4, 2026
Researchers from Defused Cyber detected attempts to exploit CVE-2026-81648 in the CryptoPayment Gateway plugin for WordPress. The vulnerability is classified as Missing Authorization and has a CVSS v3.1 score of 10.0, rated Critical. It affects versions 1.2.1 through 1.2.2 and could allow unauthenticated attackers to invoke administrative functions, delete files on the server, modify payment gateway settings, and access wallet credentials stored in cleartext. Exploitation attempts have been observed in the wild, although there is currently no confirmed evidence that websites have been successfully compromised or that digital assets have been stolen as a result.
The vulnerability exists because an AJAX endpoint in the plugin does not properly enforce authorization checks. This allows an attacker without a WordPress account to send requests that invoke functions intended to be restricted to authorized users. Successful exploitation could result in file deletion, modification of payment settings, or access to stored wallet credentials. Version 1.2.2 remains the latest available release and no patched version is currently available. The plugin was removed from the WordPress Plugin Directory on August 28, 2026, for security-related reasons.
Administrators of websites using CryptoPayment Gateway should review their systems and remove the plugin, as no fixed version is currently available. Wallet keys and other credentials previously stored through the plugin should be rotated, and payment gateway configurations and website files should be checked for unauthorized changes. Administrators should also review web server logs for requests related to the plugin originating from unknown or suspicious sources. If abnormal activity is identified, organizations should assess the scope of potential impact and follow their established cybersecurity incident response procedures.
Source: https://thehackernews.com/2026/11/attackers-target-unpatched.html