Cybersecurity
Attackers target CryptoPayment Gateway plugin flaw
Defused Cyber said attackers were trying to exploit a critical flaw in the CryptoPayment Gateway WordPress plugin, which NIST said could let unauthenticated users delete files and recover wallet credentials.
- Defused Cyber said it was observing exploitation attempts against CVE-2026-81648.
- NIST’s vulnerability database said versions 1.2.1 through 1.2.2 lacked an authorisation check on an AJAX endpoint.
- WP Scan said there were no known fixes for the flaw.
- The WordPress Plugin Directory had closed the plugin on 28 August 2026 because of an unspecified security issue.
Defused Cyber said it was seeing attempts to exploit CVE-2026-81648 in the CryptoPayment Gateway WordPress plugin. It said the attacks were coming from infrastructure marketed as anonymous, KYC-free VPS hosting.
NIST’s National Vulnerability Database said the plugin’s versions from 1.2.1 to 1.2.2 did not enforce an authorisation check on one AJAX endpoint. NIST said that allowed unauthenticated users to carry out administrative actions, including deleting files, changing payment gateway configuration and recovering wallet credentials in cleartext.
The article said the flaw carried a CVSS score of 10.0 and affected versions 1.2.1 through 1.2.2, which it described as the latest release. WP Scan said there were no known fixes.
The WordPress Plugin Directory closed the plugin on 28 August 2026 because of an unspecified security issue. The article said the plugin had been downloaded 1,845 times in total and 20 times in the previous seven days, and that it was unclear whether it was installed on any sites.
Named in this story
Companies
- Defused Cyber
- said it was seeing exploitation attempts
- WP Scan
- said there were no known fixes
Governments and agencies
- NIST National Vulnerability Database
- described the flaw and its effects
Products and systems
- CryptoPayment Gateway WordPress plugin
- was the vulnerable software at issue
- WordPress Plugin Directory
- closed the plugin for an unspecified security issue
- WordPress
- was the platform the plugin targeted
How the source tells it
The piece used a security-advisory register, with alarm and urgency coming from severity labels, active-exploitation claims, and remediation advice.
- alarm severity labelling and a worst-case description of what the flaw could permit
- urgency active-exploitation wording and immediate mitigation advice