The critical vulnerability CVE-2026-81648 with a CVSS 10.0 score has been discovered in the CryptoPayment Gateway WordPress plugin versions 1.2.1 and 1.2.2. The vulnerability allows an unauthenticated attacker to delete arbitrary files on the server, overwrite the payment gateway configuration, and extract stored cryptocurrency wallet credentials in cleartext. No patch is available — the plugin was removed from the WordPress directory on August 28, 2026 due to a security issue. Site owners using this plugin must remove it immediately and rotate their wallet keys.
Technical details of the vulnerability
The root cause is the lack of authorization checks on one of the plugin’s AJAX endpoints. According to WPScan, this allows any unauthenticated user to invoke administrative operations. The vulnerability is classified as CWE-284 (Improper Access Control).
According to the description in WPScan, exploitation opens up three attack vectors:
- Deletion of arbitrary files on the server — including critical WordPress files, which can lead to a complete site outage
- Overwriting of the payment gateway configuration — allows redirecting payments to attacker-controlled addresses
- Extraction of wallet credentials in cleartext — direct access to cryptocurrency assets
An important technical detail: according to WPScan, most exploitation steps require that the plugin has been activated at least once, but arbitrary file deletion is possible even without prior activation — the mere presence of the plugin files in the wp-content/plugins directory is enough. No user account or active session is required for any of the vectors.
Affected versions and absence of a patch
The vulnerability affects versions 1.2.1 and 1.2.2 of the CryptoPayment Gateway plugin. A critically important point: version 1.2.2, listed in the WordPress directory as the latest available release, falls within the vulnerable range. This means that updating to the latest version does not fix the issue — the only option is complete removal of the plugin.
WPScan states that no fix exists. The WordPress Plugin Directory confirms that the plugin was removed on August 28, 2026 with the note “Security Issue” — the plugin is no longer available for download. At the same time, the number of active installations in the directory is shown as “N/A”, which makes it impossible to assess the true scale of the threat.
Reports of exploitation attempts
Defused Cyber reported observing attempts to exploit CVE-2026-81648 in the wild. It should be emphasized that this statement is based on a single source and has not been confirmed by independent observers — neither CISA nor other organizations have included this vulnerability in catalogs of actively exploited issues. The exploitation status should be treated as unconfirmed rather than as an established fact of widespread compromise.
Impact assessment
Although the plugin has a limited number of downloads, the nature of the vulnerability makes it particularly dangerous. The combination of three factors — no authentication required, the ability to extract cryptocurrency keys in cleartext, and the lack of a patch — creates conditions for direct financial losses. Even a single compromised installation can result in the theft of funds from connected wallets.
The situation is aggravated by the fact that the plugin is designed to handle cryptocurrency payments, which means that affected sites are highly likely to store keys to wallets with real funds. We have previously analyzed vulnerabilities in WordPress plugins that lead to full site compromise — CVE-2026-81648 falls into the same category of critical access control issues.
Response recommendations
Since no fix exists, the only effective strategy is complete removal of the vulnerable component:
- Immediately remove the CryptoPayment Gateway plugin — deactivation is not enough, as the file-deletion vector works even when the plugin is not activated. Delete all files from the
wp-content/plugins/cryptopayment-gateway/directory - Rotate all cryptocurrency keys that were stored in the plugin configuration. Treat all previously used keys as compromised
- Verify the integrity of WordPress files — make sure critical files (
wp-config.php,.htaccess) have not been deleted or modified - Audit your configuration — check whether payment gateway settings have been changed and ensure there are no suspicious administrator accounts
- Review access logs for unusual AJAX requests to the plugin’s endpoints
Site owners with CryptoPayment Gateway versions 1.2.1 or 1.2.2 installed must prioritize removing the plugin and rotating wallet keys — the lack of a patch and the maximum CVSS 10.0 score leave no room for a wait-and-see approach. Move funds from potentially compromised wallets to new addresses with new keys before completing the audit.
