CVE-2026-81648
CVSS 10 CRITICAL: the CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its… EPSS 0.5% (43rd percentile).
Vulnerabilities · 2h ago
Defused Cyber says attackers are attempting to exploit a flaw in CryptoPayment Gateway for WordPress, affecting versions 1.2.1 through 1.2.2, the latest release. There is no fixed version, and the plugin was removed from the WordPress directory on August 28, 2026.
The plugin’s web-request endpoint performs administrator-level tasks without checking who sent the request. An unauthenticated visitor can use it to retrieve stored wallet credentials in readable form, delete server files, or overwrite payment settings—so exploitation can expose keys as well as alter the site.
If a site stored wallet keys in the plugin, removing it does not revoke credentials an attacker may already have obtained. The reports confirm exploit attempts, but do not establish whether any credentials were successfully retrieved.
CVSS 10 CRITICAL: the CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its… EPSS 0.5% (43rd percentile).
1 source covering this story
Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials
Attackers are attempting to exploit an unpatched CryptoPayment Gateway WordPress flaw that could expose wallet credentials and delete files.
Part of the PlainSec briefing for 2026-11-03