Attackers Target Unpatched WordPress CryptoPayment Gateway Flaw, Researchers Warn

Attackers are attempting to exploit an unpatched, maximum-severity security flaw in the CryptoPayment Gateway plugin for WordPress, according to a report published on 3 November 2026. The flaw could let someone without an account on a site delete files, change payment settings and recover stored wallet credentials in clear text.

The report, by The Hacker News, is based on findings from security firm Defused Cyber, which said it is observing exploitation attempts in the wild. The vulnerability is tracked as CVE-2026-81648 and carries the highest possible severity score, 10.0 on the CVSS scale.

The flaw affects CryptoPayment Gateway versions 1.2.1 through 1.2.2, which is the latest version of the plugin. According to the description of the flaw on the NIST National Vulnerability Database, quoted in the report, the plugin “does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext.”

In other words, an attacker would not need to log in to the affected site to attempt these actions. Defused Cyber said the attacks it recorded came from infrastructure that markets itself as “Anonymous KYC-Free VPS Hosting.”

There is no known fix for the flaw, according to WPScan, cited in the report. The plugin has also been closed on the WordPress Plugin Directory since 28 August 2026 and is no longer available for download, because of an unspecified “security issue.” The report notes that the plugin has been downloaded 1,845 times in total, including 20 downloads over the last seven days, although it is unclear whether it is actively installed on any WordPress sites.

The report does not identify any confirmed victims or confirmed compromises. What it documents is exploitation attempts — attackers probing for the flaw — rather than successful break-ins.

What this means for your business

If your website runs WordPress and takes payments, this is a reminder to check what is actually installed on your site, not just what you remember installing. Small plugins that were added for a single feature and then forgotten are a common weak point, and in this case there is no update to wait for.

Check this now:

1. Check whether the plugin is installed. In your WordPress dashboard, go to Plugins and look for CryptoPayment Gateway. If it is there, in any version from 1.2.1 to 1.2.2, treat the site as at risk.
2. Remove the plugin. The Hacker News report advises site owners to remove the plugin in the absence of a fix. Deactivating it is not the same as removing it — delete it from the site altogether.
3. Rotate your wallet keys. The report advises rotating wallet keys, because the flaw could expose stored wallet credentials in clear text. If the plugin held any live wallet credentials, assume they may have been exposed and replace them.
4. Audit for suspicious changes. Check for unexpected changes to your site’s files and to your payment gateway settings, as the report advises auditing for suspicious changes. If anything looks unfamiliar, or you are unsure what you are looking at, get help from your web developer or hosting provider before taking further payments through the site.
5. Do not wait for a patch. With no known fix and the plugin closed on the WordPress Plugin Directory, waiting for an update is not a safe option. If you still need to accept cryptocurrency payments, look for a supported, actively maintained alternative instead.

More broadly, this story underlines a habit worth keeping all year round: review your installed plugins regularly, remove anything you no longer use, and keep everything that remains up to date.

Comment

Zain Ali, founder of Zee Developers, said: “The worrying part of this story is that there is no update to fix it. When a plugin has no fix and has been pulled from the directory, the safe move is to remove it straight away and check nothing has been changed. Small businesses often have plugins sitting on their site that they forgot about years ago, and those are exactly the ones attackers go looking for.”

If you are unsure whether your WordPress site is affected, or you would like help checking your plugins and payment setup, get in touch with Zee Developers and we will be happy to help.

Sources: The Hacker News, “Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials”, 3 November 2026, reporting findings from Defused Cyber; NIST National Vulnerability Database description of CVE-2026-81648; WPScan; WordPress Plugin Directory.