Crypto Payment Vulnerability Endangers Store Owners
Recent findings reveal that store proprietors are jeopardizing customers’ cryptocurrency assets due to cybercriminals exploiting a significant vulnerability in a WordPress plugin designed for cryptocurrency transactions.
Security firm AVES Netsec reported via its Defused deception network on attempts to exploit the CVE-2026-81648 flaw, which registers a critical CVSS score of 10.0 within the CryptoPayment Gateway plugin.
This vulnerability, made public last month, empowers unauthenticated attackers to access a website’s payment-gateway settings.
This includes sensitive wallet credentials stored in cleartext format, enabling them to alter configurations without the site’s approval.
We are observing in-the-wild exploitation attempts against CVE-2026-81648, a critical (CVSS 10.0) flaw in the CryptoPayment Gateway for WordPress. There’s been no prior public report of this vulnerability being exploited in the wild.
This vulnerability lets anyone read a… pic.twitter.com/d1D2Xf7GHV
— Defused (@DefusedCyber) November 2, 2026
Details of the Exploit Attempt
Defused disclosed that its monitoring systems captured unauthorized efforts to exploit CVE-2026-81648. These incursions were traced back to servers marketed under the guise of “Anonymous KYC-Free VPS Hosting.”
The firm released comprehensive indicators of compromise, necessitating a sign-up for access on its internal platform.
This vulnerability, cataloged as CVE-2026-81648 and attributed by WPScan, holds a maximum CVSS v3.1 base score of 10.0.
Notably, it arises due to a lack of authorization checks (CWE-862) within one of the plugin’s AJAX components, namely admin-ajax.php.
CVE records indicate that an unauthorized attacker could exploit this flaw to delete random server files, manipulate payment gateway configurations, and recover sensitive cryptocurrency wallet information kept in cleartext.
The flaw poses a threat to plugin versions 1.2.1 to 1.2.2 and was first reported by researcher Pedro Pinho, with WPScan facilitating disclosure on September 13, 2026.
CryptoPayment Gateway serves as an extension for WooCommerce, enabling WordPress merchants to accept various cryptocurrencies, including Bitcoin, Bitcoin Cash, Litecoin, and Dogecoin, once they configure their wallet addresses in the plugin—settings that the vulnerability now threatens.
Urgent Removal Recommended by Experts
In a response to Defused’s announcement, security expert Prasen Shelar proposed a course of action for users currently employing the plugin: validate the wallet address stored in the gateway settings against a secure backup, monitor for unauthorized alterations, and rotate any stored credentials. This strategy was corroborated by Defused.
Additionally, researcher Ondrej Simaisch emphasized the absence of a remedial version to date, with version 1.2.2 still being the most recent release.
He cautioned that the file-deletion vulnerability could be activated even in installations where the plugin was merely downloaded but never activated, advocating for the complete removal of the plugin and rotation of wallet keys, regardless of perceived impact.
Current data from public plugin directories indicates that CryptoPayment Gateway has a limited install base, potentially containing the immediate fallout.
Nonetheless, the danger posed by exposing cleartext wallet credentials means that any site that has installed the plugin—whether active or dormant—remains at risk until its removal is finalized.
Source link: Cryptotimes.io.
