CVE-2026-81648: maximum-severity flaw in CryptoPayment Gateway
The vulnerability at the center of the alert is CVE-2026-81648, assigned a CVSS score of 10.0. According to the NIST National Vulnerability Database (NVD), the CryptoPayment Gateway WordPress plugin versions 1.2.1 through 1.2.2 "does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations." That description explicitly lists the range of operations an attacker could trigger through the flaw.
How attackers are attempting to exploit the flaw
Security researchers at Defused Cyber reported observing active exploitation attempts in the wild, posting that attacks they recorded "came from infrastructure that markets themselves as 'Anonymous KYC-Free VPS Hosting.'" The firm’s public notification framed the activity as ongoing attempts to weaponize the unpatched, maximum-severity vulnerability.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildImmediate technical effects: deleted files, overwritten configuration, exposed wallet credentials
The NVD description details the potential impacts programmatically available to unauthenticated users who successfully exploit the vulnerable AJAX endpoint. The actions include deleting arbitrary files on the server, overwriting the payment gateway configuration, and recovering stored wallet credentials in cleartext. The ability to extract cleartext wallet credentials is central to the risk profile described in the advisory.
Distribution status and availability on WordPress Plugin Directory
The flaw affects versions 1.2.1 through 1.2.2 of the CryptoPayment Gateway plugin; 1.2.2 is identified as the latest available release at the time of the advisory. As of August 28, 2026, the plugin was closed on the WordPress Plugin Directory and is no longer available for download there, a change attributed to an unspecified "security issue." WP Scan reports that there are no known fixes for the vulnerability.
Download figures published alongside the advisory show the plugin was collectively downloaded 1,845 times, including 20 downloads over the most recent seven-day window reported. The advisory explicitly notes it is unclear whether the plugin remains actively installed on any WordPress sites despite the directory closure.
What site owners, security teams, and attackers will do
- Site owners: The advisory recommends that site owners remove the plugin where present, rotate wallet keys, and audit their sites for suspicious changes. Those three steps are presented as the primary mitigations in the absence of an available fix.
- Security teams and incident responders: Defused Cyber’s report of active exploitation attempts signals that detection and log review for indicators tied to the vulnerable AJAX endpoint should be prioritized, and that evidence of file deletions or configuration overwrites merits immediate forensic attention.
- Adversaries and script-kiddie operators: The recorded attacks used hosting marketed as "Anonymous KYC-Free VPS Hosting," underlining that attackers are employing anonymity-friendly infrastructure to carry out scans and exploitation attempts. That behavioral detail points to continued opportunistic scanning until a patch or other mitigations are broadly applied.
At present, the public record in this advisory is stark: a maximum-severity vulnerability (CVE-2026-81648) in CryptoPayment Gateway allows unauthenticated administrative operations that can expose wallet credentials, the plugin has been removed from the WordPress Plugin Directory since August 28, 2026, there is no known fix according to WP Scan, and researchers have observed exploitation attempts originating from self-described anonymous VPS hosts. The practical, immediate choices available to site owners are likewise explicit — remove the plugin, rotate wallet keys, and audit for suspicious changes — and those steps are the only mitigations spelled out while a code-level fix remains unavailable.
Read the original report: https://thehackernews.com/2026/11/attackers-target-unpatched.html
