CryptoPayment Gateway pulled in August, still no patch

An AJAX endpoint in the CryptoPayment Gateway plugin for WordPress runs administrative operations without checking who is calling it. That gap is CVE-2026-81648, scored CVSS 10.0, and Defused Cyber reports in-the-wild exploitation attempts against it.

The missing authorization check exposes several actions at once. The NVD entry says an unauthenticated request to the endpoint can delete arbitrary files on the server, overwrite the payment gateway configuration, and recover stored wallet credentials in cleartext.

Affected versions run from 1.2.1 through 1.2.2, and 1.2.2 is the latest release. There is no patched version. WP Scan lists no known fix, and the WordPress Plugin Directory closed the plugin on August 28, 2026 over an unspecified “security issue,” so the official download is gone entirely.

The install base looks small. The plugin has been downloaded 1,845 times in total, 20 of them in the last seven days, and it is unclear how many of those downloads ended up as live installs on real sites. A CVSS 10.0 on a plugin almost nobody runs is still a CVSS 10.0 on whoever does run it, and anyone handling crypto payments through a plugin with no fix is a high-value target by definition.

Defused Cyber says the exploitation attempts it recorded came from infrastructure that markets itself as “Anonymous KYC-Free VPS Hosting.” That fits the shape of the target: wallet credentials recoverable in cleartext through an unauthenticated endpoint are a direct route to funds.

With no patch and the plugin pulled from the directory, the fix is to remove it. Then rotate every wallet key the plugin had access to, and treat anything it stored as already compromised, because the cleartext read gives an attacker exactly those keys. The arbitrary-file-delete and config-overwrite primitives mean the site itself may have been changed, so audit for deleted or modified files and check whether the gateway configuration still points where you set it.