Attackers are attempting to exploit an unpatched critical vulnerability in the CryptoPayment Gateway WordPress plugin, according to Defused Cyber, which reported observing exploitation attempts in the wild on November 3.
The flaw, tracked as CVE-2026-81648 and rated CVSS 10.0, affects plugin versions 1.2.1 through 1.2.2. A missing authorization check on an AJAX endpoint can let unauthenticated attackers invoke administrative functions, including deleting arbitrary files, overwriting payment-gateway settings and recovering stored wallet credentials in cleartext, according to the NVD record and WPScan.
Defused Cyber said the attempts originated from infrastructure advertising itself as anonymous, KYC-free VPS hosting. Its report describes attempts, not confirmed compromises or identified victims.
The WordPress Plugin Directory lists CryptoPayment Gateway as closed since August 28, 2026, and unavailable for download because of an unspecified security issue. WPScan lists no known fix for the vulnerability.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
