A zero-day vulnerability in the CryptoPayment Gateway plugin for WordPress is being actively targeted by attackers. The weakness allows unauthenticated users to perform administrative actions—specifically deleting files, overwriting configuration, and recovering sensitive wallet credentials in cleartext. The plugin versions affected are 1.2.1 through 1.2.2. The issue, tracked as CVE-2026-81648, has been given the maximum possible severity ranking (CVSS score of 10.0).
The flaw was uncovered by cybersecurity researchers at Defused Cyber, who warn that anyone without login credentials can hit an exposed AJAX endpoint to trigger administrative-level actions on sites running the vulnerable plugin. Despite being included in the latest version (1.2.2), no authorization checks were built in, meaning attackers can invoke critical functions without needing a valid user session.
Plugin Removed, But Danger Lingers
WordPress has taken down the CryptoPayment Gateway plugin as of August 28, 2026, citing a “security issue”. However, the vulnerability remains unpatched—there’s still no fixed version available. That means any site still running the plugin remains open to full compromise, even though the plugin is no longer listed in the official repository.
The download statistics show the plugin was pulled from the directory after reaching approximately 1,845 total downloads. In the week leading up to the announcement, it had seen about 20 downloads. Even if installs are few, this provides opportunity for attackers to compromise any live sites that haven’t removed it yet.
Exploitation In the Wild, What To Do Now
Defused Cyber reports real-world attacks are already happening, with campaigns originating from infrastructure marketed as “Anonymous KYC-Free VPS Hosting.” Essentially, attackers are using virtual private servers offering minimal oversight to avoid tracing.
With no security patch yet released, site administrators are being urged to immediately uninstall the plugin. Victims should also assume possible credential exposure: rotate all wallet keys associated with affected sites, and conduct a thorough audit for any signs of tampering or unauthorized changes.
Why this matters: Wallet credentials stored by WordPress payment plugins are high-value targets. Once attackers obtain them, they can redirect funds, intercept transactions, or even siphon cryptocurrency directly. Given that the plugin gave full administrative control to unauthenticated users, the potential impact is severe—even zero trust in normal login protections won’t help once the flaw is triggered.
Analytical angle: This situation is a sharp reminder that plugin security often hinges not just on version numbers, but whether critical security checks—like authorization—are correctly implemented. Unauthenticated admin-level access is among the worst kinds of bugs. For site operators, this underscores the value of continuous vulnerability scanning and rapid remediation policy. What to watch: whether the plugin’s developer publishes a patch, how long attackers leverage this before widespread removal, and whether similar oversights exist in other payment plugins.
