CryptoPayment Gateway Plugin Flaw Under Active Exploitation
Original source
Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials
The Hacker News →A critical vulnerability in the CryptoPayment Gateway WordPress plugin (CVE-2026-81648, CVSS 10.0) allows unauthenticated attackers to perform administrative functions. Missing authorization checks on an AJAX endpoint enable exploitation to delete arbitrary server files, alter payment gateway settings, and retrieve wallet credentials stored in cleartext. Versions 1.2.1 through 1.2.2 are affected, with no patches available.
Active attacks are already occurring. Defused Cyber identified exploitation attempts originating from VPS providers offering anonymous hosting without identity verification. The WordPress Plugin Directory delisted the plugin on August 28, 2026, citing unspecified security issues.
While the plugin saw limited distribution at 1,845 total downloads, deployed instances have no remediation path. Affected site owners must remove the plugin immediately, rotate wallet keys, and audit systems for unauthorized changes or configuration tampering.
Read the full article
Continue reading at The Hacker News →This is an AI-generated summary. Read the original for the full story.