Add Techlomedia as a Preferred Source on Google
A significant vulnerability within the CryptoPayment Gateway plugin for WordPress presents a perilous opportunity for malevolent actors to commandeer critical components of affected websites without any authentication requirements.
This flaw permits unauthorized assailants to delete server files, manipulate payment gateway configurations, and extract cryptocurrency wallet credentials in an unencrypted format.
Designated as CVE-2026-81648, this vulnerability has been assigned a maximum CVSS severity rating of 10.0. Alarmingly, cybersecurity experts have documented instances of exploitation attempts occurring in real-time, with no confirmed security patches currently available to mitigate the issue.
We are observing in-the-wild exploitation attempts against CVE-2026-81648, a critical (CVSS 10.0) flaw in the CryptoPayment Gateway for WordPress. There’s been no prior public report of this vulnerability being exploited in the wild.
This vulnerability lets anyone read a… pic.twitter.com/d1D2Xf7GHV
— Defused (@DefusedCyber) November 2, 2026
The vulnerability affects versions 1.2.1 and 1.2.2 of the CryptoPayment Gateway. Notably, version 1.2.2 is also the latest release, which means users are unable to rectify the issue by merely updating to a newer version.
As a WooCommerce extension, CryptoPayment Gateway facilitates the acceptance of cryptocurrency payments—such as Bitcoin, Bitcoin Cash, Litecoin, and Dogecoin—by online retailers.
Store proprietors input their wallet addresses into the plugin’s settings, enabling customers to effect transactions directly. It is precisely these settings that are at the epicenter of the security crisis.
The vulnerability stems from an AJAX endpoint that inadequately verifies whether a user possesses the requisite permissions to execute administrative tasks.
WordPress employs admin-ajax.php to manage AJAX requests from various plugins and themes; however, this instance allows sensitive operations to be exposed through that endpoint without necessitating an authenticated administrator session.
Attackers can exploit this vulnerability sans a WordPress account or any user interaction. They need only to dispatch meticulously crafted requests to the compromised endpoint, triggering functions that are intended solely for authorized users.
This vulnerability enables several hazardous operations. Malefactors can access payment gateway settings, modify configurations, and retrieve wallet credentials in plaintext.
They can also initiate arbitrary file deletion on the server, risking significant disruption to the website, elimination of critical files, or even a complete operational breakdown.
The possibility of altering payment configurations is particularly alarming, as it could allow attackers to substitute a merchant’s wallet address for their own, redirecting future cryptocurrency transactions.
Defused, a cybersecurity firm associated with AVES Netsec, has tracked attempts to exploit this vulnerability.
Such activities were reported on November 2, originating from infrastructure deemed anonymous VPS hosting that eschews KYC verification.
While this indicates active exploitation attempts, it does not ascertain that each targeted website has been successfully breached.
This vulnerability was disclosed in September 2026 and credited to cybersecurity researcher Pedro Pinho, with WPScan orchestrating the disclosure.
The plugin was already removed from the official WordPress Plugin Directory on August 28 due to a prior security flaw.
Consequently, it is no longer available for download. However, the mere removal from the directory does not eliminate its presence on websites where it had been previously installed.
Interestingly, the plugin has a relatively modest distribution footprint. Statistics from the WordPress directory cited by The Hacker News reveal 1,845 downloads, with just 20 occurring in the week leading up to the report.
Although this may limit the number of potentially affected websites, it does not mitigate the risk for store owners who still have the plugin active.
Webmasters utilizing the CryptoPayment Gateway should immediately check for its presence on their websites. Waiting for a security update is ill-advised.
Researchers caution that even installations where the plugin was downloaded but not activated could still be vulnerable. It is essential to deactivate and entirely remove the cryptopayment-gateway plugin from your site.
Removing the plugin is merely the preliminary step. If your store has historically employed it for cryptocurrency transactions, you must rotate wallet keys and any credentials associated with the plugin.
Verify your current wallet addresses and payment gateway configurations against a reliable backup. Scrutinize for any unexpected modifications, absent files, dubious administrator accounts, and anomalous requests targeting wp-admin/admin-ajax.php.
Should you detect signs of compromise, restore affected files from a pristine backup and conduct an in-depth investigation of the site prior to resuming normal operations.
Furthermore, it is prudent to review other WordPress plugins and themes incorporated within your website.
Ensure that the WordPress core, plugins, and themes are consistently updated, retire unused extensions, and maintain regular backup protocols.
A web application firewall may assist in obstructing suspicious requests; however, it should not substitute for the removal of vulnerable software.
This incident serves as a stark reminder that the installation of a popular plugin does not inherently secure a website. A singular oversight in authorization checks can expose administrative functionalities to any internet user.
Developers must rigorously validate user permissions for every sensitive action, carefully sanitize input, and refrain from revealing confidential information via public endpoints.
WordPress continues to be a versatile platform for commercial websites and online storefronts, yet it necessitates diligent development practices and ongoing security vigilance.
At Techlomedia, we also proffer custom WordPress development, plugin and theme development, security audits, vulnerability assessments, and website fortification services.
If you operate a WordPress site or WooCommerce store and seek to augment its security, performance, or functionality, reach out to Techlomedia.
We possess the expertise to assist you in crafting and maintaining a website that is better equipped to face security threats.
Source link: Techlomedia.in.
