Attackers Exploit CryptoPayment Gateway Flaw to Steal Wallet Keys

Threat actors are attempting to exploit CVE-2026-81648, a critical, maximum-severity flaw in the CryptoPayment Gateway WordPress plugin, according to findings from Defused Cyber.

The NVD description states the vulnerability “does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext.” The CVSS score is 10.0. The affected versions run from 1.2.1 to 1.2.2, which is identified as the latest version, and WPScan reports there are no known fixes. As of 28 August 2026, the plugin has been closed on the WordPress Plugin Directory due to a security issue, and it may no longer be downloadable.

Defused Cyber indicates that in-the-wild exploitation attempts have been observed, with traffic coming from infrastructure marketed as “Anonymous KYC-Free VPS Hosting.” The attacker activity could allow unauthenticated users to delete arbitrary files, overwrite the gateway configuration, and recover wallet credentials in cleartext. The article notes a lack of fixes and provides practical responses: remove the plugin, rotate wallet keys, and audit for suspicious changes.

The guidance is attributed to Defused Cyber via an X post. Sources are cited to attribute each claim: the NVD description for the flaw, WPScan for the lack of fixes, and Defused Cyber for in-the-wild exploitation and attribution.