CVE-2026-81648
CVSS 10 CRITICAL: the CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its… EPSS 0.5% (43rd percentile).
Vulnerabilities & Exploits · Zero-Day Exploit
Defused Cyber says attackers are attempting to exploit a flaw in CryptoPayment Gateway for WordPress, affecting versions 1.2.1 through 1.2.2, the latest release. There is no fixed version, and the plugin was removed from the WordPress directory on August 28, 2026.
The plugin’s web-request endpoint performs administrator-level tasks without checking who sent the request. An unauthenticated visitor can use it to retrieve stored wallet credentials in readable form, delete server files, or overwrite payment settings—so exploitation can expose keys as well as alter the site.
If a site stored wallet keys in the plugin, removing it does not revoke credentials an attacker may already have obtained. The reports confirm exploit attempts, but do not establish whether any credentials were successfully retrieved.
1 source · 3h ago
CVSS 10 CRITICAL: the CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its… EPSS 0.5% (43rd percentile).
The Hacker News
Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials
Attackers are attempting to exploit an unpatched CryptoPayment Gateway WordPress flaw that could expose wallet credentials and delete files.
originalPart of the PlainSec briefing for 2026-11-03
Every edition of this story: CryptoPayment Gateway flaw exposes stored wallet keys