Cybersecurity experts have identified a significant vulnerability in the CryptoPayment Gateway plugin for WordPress, raising alarms over potential security breaches. This flaw, cataloged as CVE-2026-81648, possesses the highest severity rating, with a CVSS score of 10.0, indicating a critical risk to users’ data integrity.
Understanding the Security Breach
The vulnerability affects versions 1.2.1 to 1.2.2 of the CryptoPayment Gateway plugin. It allows unauthorized users to perform administrative functions, such as deleting files and accessing sensitive information like wallet credentials. This issue arises from a lack of authorization checks on a specific AJAX endpoint, leaving the plugin wide open to exploitation.
Despite its critical nature, no patches or updates have been released to address this security gap. The plugin was removed from the WordPress Plugin Directory on August 28, 2026, due to unspecified security issues, leaving users without an official resolution.
Exploitation Attempts in the Wild
Security firm Defused Cyber has reported ongoing attempts to exploit this vulnerability. Attackers are leveraging infrastructure that promotes anonymous, KYC-free VPS hosting, suggesting a coordinated effort to breach systems using this plugin. These actions highlight the urgent need for site owners to take protective measures.
Data from WP Scan reveals that the plugin had been downloaded 1,845 times, with 20 downloads occurring in the last week alone. However, it remains unclear how many active installations are still vulnerable to attacks.
Mitigation Measures for Site Owners
In the absence of an available fix, experts strongly advise the removal of the CryptoPayment Gateway plugin from all WordPress sites. Additionally, site administrators should rotate wallet keys and conduct thorough audits for any unauthorized changes to their systems. These steps are crucial in safeguarding sensitive information and preventing potential data breaches.
As cyber threats evolve, maintaining robust security practices and staying informed about vulnerabilities are essential to protect digital assets. Users are encouraged to monitor official channels for updates and consider alternative solutions to ensure continued security.
