Attacks on websites due to an unpatched vulnerability in a known plugin
CVE-2026-81648 is an unpatched CVSS 10 vulnerability in the CryptoPayment Gateway WordPress plugin versions 1.2.1 to 1.2.2 caused by a missing authorization check on an AJAX endpoint. Unauthenticated attackers can delet
CVE-2026-81648 is an unpatched CVSS 10 vulnerability in the CryptoPayment Gateway WordPress plugin versions 1.2.1 to 1.2.2 caused by a missing authorization check on an AJAX endpoint.
Unauthenticated attackers can delete arbitrary files and extract cleartext wallet credentials.
Exploitation attempts have been observed, and with no fix available, site owners should remove the plugin and rotate keys.
The issue affects the CryptoPayment Gateway add-on in versions 1.2.1 and 1.2.2. According to security researchers, the issue allows unknown parties to perform administrative actions without having to be logged in, allowing them to delete files and retrieve digital wallet details stored in plain text.
Researchers from the Defused Cyber ββgroup reported that they have already recorded attempts to exploit the problem from infrastructures promoted as anonymous hosting without identifying information.
The plugin has been removed from the official WordPress repository since August 28, 2026 due to security issues and is no longer available for download, with a total of 1.845 downloads, including 20 downloads in the last week.
β³
READ ALSO
HACKS.GR / RELATED
Vulnerabilities & Security Updates
Security flaw in Siemens devices used in attacks
β
As no official update has been released to fix the problem, website administrators are urged to completely remove the add-on, change their wallet keys, and check for any suspicious changes.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
β
end of article
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes β full credit and traffic to the original publisher.