Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials

Users of the CryptoPayment Gateway WordPress plugin are facing active exploitation attempts against a maximum-severity flaw. Defused Cyber observed attacks in the wild. The plugin’s latest version is affected, and no fix is currently available. This creates an immediate risk for sites using the plugin.

An attacker does not need an account to reach the vulnerable function. The flaw lets unauthenticated visitors invoke administrative operations through a WordPress AJAX endpoint. Those operations can include deleting arbitrary server files, changing payment gateway configuration, and recovering wallet credentials stored in cleartext.

The plugin was closed on the WordPress Plugin Directory on August 28, 2026, because of an unspecified security issue. Its total downloads reached 1,845, although active installations are unknown. Site owners should remove the plugin, rotate wallet keys, and check for suspicious changes while waiting for further information.

CVE-2026-81648 is the identifier assigned to the CryptoPayment Gateway plugin vulnerability. CVE numbers provide a common way to track and discuss individual security flaws. CVSS is a scoring system that estimates vulnerability severity using factors such as attack conditions and possible impact. A score of 10.0 is the maximum rating.

Here, the high score reflects a flaw that requires no authenticated account and can expose powerful administrative actions. Successful exploitation could let attackers delete arbitrary files, overwrite payment gateway configuration, and recover wallet credentials stored in cleartext. These outcomes affect both site operation and financial security.

The danger is not merely theoretical. Defused Cyber reported exploitation attempts in the wild, and the affected plugin version is the latest release. Because no fix is known, site owners should remove the plugin, rotate wallet keys, and audit their sites for suspicious changes.

WordPress AJAX endpoints let plugins receive requests and perform actions without loading a normal page. Administrative actions should first verify that the requester is authorized. Without that check, the endpoint may treat an ordinary visitor’s request like a trusted administrator’s command.

For CryptoPayment Gateway, the missing check affects one AJAX endpoint. An unauthenticated user can invoke operations that should be restricted, including deleting arbitrary files on the server, overwriting payment gateway configuration, and recovering stored wallet credentials in cleartext. The attacker therefore does not need a WordPress account before attempting these actions.

This design failure matters because one publicly reachable function can expose several high-impact capabilities at once. Defused Cyber says attackers are already attempting exploitation. Since versions 1.2.1 through 1.2.2 are affected and no fix is known, removing the plugin is the advised defensive step.

Exploiting the flaw could give attackers control over several sensitive areas of a WordPress site. They could delete arbitrary files from the server, potentially damaging site functionality or removing important data. They could also overwrite the payment gateway configuration, changing how cryptocurrency payments are handled.

The most direct financial risk is credential exposure. The vulnerability can recover stored wallet credentials in cleartext. For example, an attacker could use the endpoint without authenticating, extract those credentials, and then potentially access the associated wallet. The article does not state whether funds were stolen, but the exposed credentials create a serious security concern.

Attackers could also leave suspicious changes behind or disrupt payment processing. Defused Cyber has observed exploitation attempts, while the plugin remains without a known fix. Site owners are advised to remove it, rotate wallet keys, and audit for unauthorized file or configuration changes.

Exposure is difficult to measure precisely. The affected range covers versions 1.2.1 through 1.2.2, and version 1.2.2 is the latest release. That means updating within the known plugin versions would not remove the risk. The article does not provide a count of active installations.

The plugin has been downloaded 1,845 times in total, including 20 downloads during the last seven days. Those figures show that the plugin was distributed and may still be reaching users, but downloads do not prove how many sites currently run it. Some copies may have been removed, while others may remain active.

The WordPress Plugin Directory closed the plugin on August 28, 2026, and it is no longer available there. Even so, existing installations may remain. Owners should identify the plugin on their sites, remove it, rotate wallet keys, and inspect for suspicious activity.

A vulnerable plugin without a fix cannot be made safe through a normal update. Site owners should remove CryptoPayment Gateway from affected WordPress sites, following the article’s advice. This blocks the vulnerable component from continuing to expose its AJAX endpoint, although removal alone does not erase damage that may already have occurred.

Owners should also rotate wallet keys because the flaw can recover stored wallet credentials in cleartext. They should audit their sites for suspicious changes, including altered payment gateway configuration or unexpected file activity. The article specifically recommends these steps after reporting exploitation attempts.

The plugin was closed on the WordPress Plugin Directory on August 28, 2026, and is unavailable for download there. That does not confirm that every existing installation is gone. Until a fix appears, removing the plugin, changing wallet credentials, and reviewing the site are the stated protective measures.

WordPress plugins can add payment features to a website by connecting checkout or payment forms with a cryptocurrency payment gateway. They may store configuration details and wallet credentials so the site can process or track payments. The source identifies CryptoPayment Gateway as such a plugin and refers to its payment gateway configuration and stored wallet credentials.

That information must be protected because wallet credentials can control access to cryptocurrency funds or payment operations. In this case, the missing authorization check on an AJAX endpoint lets unauthenticated users invoke administrative operations. One possible operation is recovering stored wallet credentials in cleartext, while another is overwriting the payment configuration.

The article does not describe the plugin’s exact technical integration or wallet architecture. It does establish that the plugin handles payment settings and wallet credentials, and that attackers are attempting exploitation. Owners should remove it, rotate wallet keys, and audit for suspicious changes.