CryptoPayment Gateway WordPress plugin flaw CVE-2026-81648 now actively exploited

What happened

The CryptoPayment Gateway plugin for WordPress has a vulnerability, tracked as CVE-2026-81648, that became public on 13 September 2026. Active exploitation was confirmed on 3 November 2026. The vulnerability is not new, but it is now being used in real attacks. Any site that has not been fixed since the disclosure is at risk.

One of the plugin's AJAX endpoints does not check whether the caller is authorized. Unauthenticated visitors can therefore run administrative operations. According to the advisory, these include:

• deleting arbitrary files on the server
• overwriting the payment gateway configuration
• recovering the stored wallet credentials in cleartext

The vulnerability has a CVSS base score of 10.

Who is affected

All WordPress sites running the CryptoPayment Gateway plugin in versions 1.2.1 to 1.2.2 are affected. No login is needed to exploit the flaw. Every public site with an affected version installed is exposed, even if the plugin is rarely used.

The source data does not name a fixed version, and reports describe the flaw as unpatched. Check the vendor advisory linked below to see whether a fixed release is available.

What to do now

1. Find every WordPress installation you manage that has the plugin. Example: wp plugin list --name=cryptopayment-gateway with WP-CLI, or look at the plugin list in the admin area. The plugin slug may differ; check the folder name under wp-content/plugins/.
2. Back up the site files and the database.
3. If the advisory lists a fixed version, update to it. If no fix is available, deactivate and remove the plugin until one is released. Use another payment method in the meantime.
4. Treat the stored wallet credentials as compromised. Rotate any API keys, wallet keys or passwords that were configured in the plugin, and move funds if needed.
5. Check the payment gateway configuration for changes, especially wallet addresses and callback URLs. Payments could otherwise be redirected to attackers.
6. Check that the site and the shop still work after the change.

How to check whether you are affected

• Confirm the installed plugin version. Versions 1.2.1 and 1.2.2 are vulnerable.
• Search the web server access logs for requests to /wp-admin/admin-ajax.php that come from unknown IP addresses and reference the plugin's actions. Pay particular attention to the period since 13 September 2026.
• Look for missing or recently deleted files, for example wp-config.php or .htaccess. Deleting such files can break the site or let it be reinstalled under an attacker's control.
• Compare the current wallet addresses in the plugin settings with your own records.
• Check the wallet transaction history for transfers you did not make.

If you find signs of compromise, restore the site from a clean backup and rotate all credentials, including WordPress admin and database passwords.

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-81648
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog