Attackers are attempting to exploit CVE-2026-81648, a maximum-severity flaw in the CryptoPayment Gateway WordPress plugin that has no known fix. The bug lets unauthenticated users run administrative actions, including recovering stored cryptocurrency wallet credentials in cleartext.
Missing Authorization Check Gives Unauthenticated Users Admin Actions
CVE-2026-81648 has a CVSS score of 10.0 and affects plugin versions 1.2.1 to 1.2.2. According to the NVD description, an AJAX endpoint in the plugin lacks an authorization check. That omission allows unauthenticated users to run administrative functions on the site.
The functions the NVD lists include deleting arbitrary files, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext. Each of those affects a payment site differently: file deletion can disable the site or remove security controls, configuration overwrites can redirect payments, and recovered credentials give an attacker direct control of the wallet.
Exploitation Attempts Traced to Anonymous VPS Hosting
Defused Cyber reported in-the-wild exploitation attempts. The traffic came from infrastructure marketed as “Anonymous KYC-Free VPS Hosting,” a category of provider that sells servers without identity verification. The report describes attempts rather than confirmed compromises, and it does not say whether any site has lost wallet funds.
Plugin Closed in August With No Patch Available
There is no known fix for the flaw. The WordPress Plugin Directory closed the plugin on August 28 for an unspecified “security issue.” It is not clear whether that closure relates to CVE-2026-81648, since the directory did not publish details.
The plugin has 1,845 total downloads, of which 20 occurred in the last seven days. How many sites still run it is unclear, and download totals do not reveal how many copies remain active.
1,845 Downloads Limit Exposure, but Wallet Theft Is Severe
The low download count limits the number of exposed sites, but the severity for any individual site is high. A payment gateway plugin stores the credentials needed to receive and move money, so a flaw that discloses them in plain text hands over the wallet itself. A site owner who loses those keys cannot recover transferred cryptocurrency.
Remove the CryptoPayment Gateway Plugin and Rotate Wallet Keys
With no patch, the advised steps are to remove the plugin, rotate wallet keys and audit the site for suspicious changes. Rotating keys matters because anyone who already retrieved the cleartext credentials could use them later, even after the plugin is gone.
The audit step addresses the other capabilities the flaw grants. An attacker able to overwrite the payment gateway configuration could leave behind altered settings that persist after the plugin is deleted, such as a changed receiving address.
Closed CryptoPayment Gateway Plugin Remains a Risk on Existing Sites
The case shows how a closed plugin can remain a risk after it leaves the official directory. Sites that installed it earlier keep running the code, and WordPress does not remove closed plugins automatically. Administrators who never saw the August closure have no built-in prompt to act.
The pairing of a perfect severity score with a fix that does not exist is rare, and it leaves removal as the only reliable defense. The attempts came from unverified-identity hosting, which keeps the people probing for the flaw hard to trace.
Unknowns: Vendor Fix, Closure Reason and Vulnerable Site Count
Several basics are missing. The plugin’s author has not issued a fix or a statement in the reporting, the directory has not said why it closed the plugin, and there is no count of vulnerable sites. Defused Cyber’s observation that exploitation attempts are already under way is the only public evidence of attacker interest, and it leaves open whether any attempt has succeeded in extracting wallet credentials from a live site.
