Security researchers at Defused Cyber have observed active exploitation attempts against an unpatched vulnerability in the CryptoPayment Gateway WordPress plugin. The flaw, tracked as CVE-2026-81648, carries a maximum CVSS score of 10.0, reflecting the severity of what an attacker could achieve without authentication.

According to the findings, successful exploitation would let unauthenticated attackers delete arbitrary files on the hosting server. In the context of a cryptocurrency payment plugin, this type of access raises serious concerns about the potential exposure of wallet credentials and other sensitive payment configuration data stored alongside the plugin.

Why This Matters

WordPress plugins handling cryptocurrency payments are high-value targets because they often store or process sensitive financial data, including API keys and wallet information. An unauthenticated arbitrary file deletion vulnerability can be leveraged in several damaging ways, including:

  • Disrupting site functionality by deleting critical configuration files
  • Resetting or bypassing security controls tied to specific files
  • Chaining with other weaknesses to escalate access or achieve remote code execution
  • Exposing stored credentials tied to cryptocurrency wallets or payment processing

The maximum CVSS score assigned to this vulnerability underscores both the ease of exploitation (no authentication required) and the severity of potential impact.

No Patch Available

As of the time of these findings, no official patch has been released for the CryptoPayment Gateway plugin. This leaves active installations exposed to ongoing exploitation attempts that have already been detected in the wild.

Recommendations

Site administrators running the CryptoPayment Gateway plugin should treat this as an urgent priority. Until a fix is available, organizations should consider disabling or removing the plugin, restricting access through a web application firewall, and auditing server logs for signs of file deletion or unauthorized access attempts. Any cryptocurrency wallet credentials potentially exposed through affected installations should be rotated as a precaution.