Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials
An unpatched CVSS-10 flaw in the CryptoPayment Gateway WordPress plugin is being actively probed—organisations accepting crypto payments via WordPress face credential-theft risk with no vendor fix available yet.
Summary written by editorial AI · Source link below
Threat actors are attempting to exploit an unpatched maximum-severity security vulnerability in the CryptoPayment Gateway WordPress plugin, according to findings from Defused Cyber.
The vulnerability in question is CVE-2026-81648, which carries a CVSS score of 10.0. Successful exploitation of the flaw could permit unauthenticated users to delete arbitrary files on the server and extract
Editorial Analysis
Enterprises running WordPress-based payment flows may unknowingly expose wallet credentials; the absence of a patch means the only mitigation is removal or WAF-based blocking.
Scan all WordPress instances for the CryptoPayment Gateway plugin, disable it immediately, and review WAF rules to block known exploitation vectors.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at THN (Feedburner) in a new tab.
More from the Vulnerabilities Desk
- SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks3d
- QNAP says hackers breaching NAS devices in Plex2Shell attacks3d
- Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites One Last Time3d
- [NEU] [mittel] JetBrains CLion: Mehrere Schwachstellen3d
- [UPDATE] [mittel] Keycloak: Mehrere Schwachstellen3d