Attackers target unpatched CVE-2026-81648 (CVSS 10.0) in CryptoPayment Gateway WordPress plugin that can expose wallet credentials
Threat actors are attempting to exploit CVE-2026-81648, an unpatched maximum-severity (CVSS 10.0) flaw in the CryptoPayment Gateway WordPress plugin, according to Defused Cyber. The bug lets unauthenticated users invoke administrative operations, including deleting arbitrary files, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext. Defused Cyber says the attacks came from infrastructure marketed as "Anonymous KYC-Free VPS Hosting". No fix is known, and the plugin has been closed on the WordPress Plugin Directory since August 28, 2026 for an unspecified "security issue".
Entenda a falha
A vulnerabilidade
CVE-2026-81648 (CVSS 10.0) is a missing-authorization flaw in an AJAX endpoint of the CryptoPayment Gateway WordPress plugin, versions 1.2.1 through 1.2.2 (the latest). An unauthenticated attacker can invoke administrative operations: delete arbitrary files on the server, overwrite the payment gateway configuration and recover stored wallet credentials in cleartext. The articles mention no need for user interaction or special configuration. No fixed version is known (WP Scan lists none), and the plugin has been closed on the WordPress Plugin Directory since August 28, 2026.
Como funciona
The plugin exposes an AJAX endpoint that handles administrative operations. A request reaches that endpoint on the WordPress site, and the plugin carries out the requested action, such as deleting a file, changing the gateway configuration or returning wallet credentials. It never checks whether the caller is authenticated or an administrator, so anyone who can reach the site can trigger these operations.
Por que é vulnerável
The root cause is a missing authorization check on the AJAX endpoint, so privileged functions are open to unauthenticated users. The articles also indicate that wallet credentials are stored in cleartext, which makes the exposure worse. They do not say why the flaw went unnoticed, and no fix exists yet, so there is nothing to describe about what a patch would change.
Como foi descoberta
The articles do not say who found the flaw or how it was reported. Defused Cyber reported in-the-wild exploitation attempts in an X post, saying the attacks came from infrastructure marketed as "Anonymous KYC-Free VPS Hosting". The NVD carries the description, and the plugin was closed on the WordPress Plugin Directory on August 28, 2026 for an unspecified "security issue".
Explicação gerada por IA a partir da matéria e dos artigos, em 03/11/2026 04:16.
Detalhes técnicos
- The flaw affects versions 1.2.1 through 1.2.2 (the latest version). An AJAX endpoint has no authorization check, so unauthenticated users can invoke administrative operations (per NVD).
- Impact: arbitrary file deletion, overwriting of the payment gateway configuration, and recovery of wallet credentials in cleartext.
- The plugin has about 1,845 total downloads, 20 of them in the last seven days. It is unclear how many sites have it actively installed.
- WP Scan lists no known fix.
Remediação
- Remove the plugin, since no patch exists.
- Rotate wallet keys and credentials.
- Audit the site for suspicious changes, such as altered gateway configuration or deleted files.
Linha do tempo
-
Attackers target unpatched CVE-2026-81648 (CVSS 10.0) in CryptoPayment Gateway WordPress plugin that can expose wallet credentials
ler a análise desta fonte ocultar
Threat actors are attempting to exploit CVE-2026-81648, an unpatched maximum-severity (CVSS 10.0) flaw in the CryptoPayment Gateway WordPress plugin, according to Defused Cyber. The bug lets unauthenticated users invoke administrative operations, including deleting arbitrary files, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext. Defused Cyber says the attacks came from infrastructure marketed as "Anonymous KYC-Free VPS Hosting". No fix is known, and the plugin has been closed on the WordPress Plugin Directory since August 28, 2026 for an unspecified "security issue".
Technical Details
- The flaw affects versions 1.2.1 through 1.2.2 (the latest version). An AJAX endpoint has no authorization check, so unauthenticated users can invoke administrative operations (per NVD).
- Impact: arbitrary file deletion, overwriting of the payment gateway configuration, and recovery of wallet credentials in cleartext.
- The plugin has about 1,845 total downloads, 20 of them in the last seven days. It is unclear how many sites have it actively installed.
- WP Scan lists no known fix.
Remediation
- Remove the plugin, since no patch exists.
- Rotate wallet keys and credentials.
- Audit the site for suspicious changes, such as altered gateway configuration or deleted files.