VULNpocalypse
CriticalVulnerabilityActive

Unpatched CryptoPayment Gateway WordPress plugin exploited: unauthenticated attackers can read wallet credentials in cleartext

CVE-2026-81648, a CVSS 10.0 missing authorization flaw in the CryptoPayment Gateway WordPress plugin, is being exploited and has no fix.

Published
Exploitation
Yes. Defused Cyber reports in-the-wild exploitation attempts from infrastructure marketed as “Anonymous KYC-Free VPS Hosting” (The Hacker News)

Live scores

CVE-2026-81648
EPSS
0.005
low predicted chance of attack
VEDAS
0.510
likely exploited
On CISA KEV
Not listed
Detection rule
None yet

What happened

CVE-2026-81648 is a missing authorization flaw in the CryptoPayment Gateway WordPress plugin. The plugin does not apply an authorization check on one of its AJAX endpoints, so unauthenticated users can invoke administrative operations (OpenCVE). Those operations include deleting arbitrary server files, overwriting the payment gateway configuration, and recovering stored wallet credentials in cleartext (The Hacker News, OpenCVE).

SentinelOne classifies the flaw as a missing authorization vulnerability (CWE-862): the plugin registers the AJAX endpoint without a capability check or nonce verification, so unauthenticated requests can trigger administrative functions, and the returned wallet credentials are not encrypted at rest (SentinelOne).

The CVE was published on 13 September 2026 and carries a CVSS v3.1 base score of 10.0 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (OpenCVE). CISA’s SSVC entry records exploitation as “poc”, automatable as “yes”, and technical impact as “total”, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog (OpenCVE).

Attackers are already probing it. Defused Cyber reports in-the-wild exploitation attempts, coming from infrastructure that markets itself as “Anonymous KYC-Free VPS Hosting” (The Hacker News).

Am I affected?

You are affected if your WordPress site runs the CryptoPayment Gateway plugin at version 1.2.1 or 1.2.2. The flaw affects versions 1.2.1 through 1.2.2, and 1.2.2 is the latest release (The Hacker News, OpenCVE).

There is no safe version to upgrade to. WPScan lists no known fix, and the WordPress plugin directory closed the plugin on 28 August 2026 over an unspecified security issue (The Hacker News). SentinelOne says no fixed version is listed in the NVD entry (SentinelOne).

To check, look under Plugins in your WordPress admin for “CryptoPayment Gateway” and note the installed version. The plugin has 1,845 total downloads, and it is unclear from the reporting whether it is actively installed on any live sites (The Hacker News).

What to do now

  1. Remove the plugin. There is no patched release, so deactivating and deleting it is the only fix (The Hacker News). SentinelOne advises disabling the plugin on affected sites until a patched release is confirmed (SentinelOne).
  2. Rotate your wallet credentials. Because the flaw can return stored wallet credentials in cleartext, treat every wallet key and API secret the plugin held as compromised and rotate them (The Hacker News).
  3. Audit the site for changes. The same endpoint can delete arbitrary server files and overwrite the payment gateway configuration, so check for suspicious changes (The Hacker News). SentinelOne suggests reviewing the plugin’s wp_options values for unexpected changes (SentinelOne).
  4. Review access logs for requests to the plugin’s AJAX endpoint, especially from hosting that advertises anonymous or KYC-free VPS, which is the source of the exploitation attempts Defused Cyber reported (The Hacker News).

Sources