Cybersecurity researchers have discovered active attempts to exploit a critical vulnerability in a WordPress cryptocy payment plugin that could expose digital wallet credentials, redirect payments and allow attackers to delete website files. The security flaw, identified as CVE-2026-81648, affects the CryptoPayment Gateway plugin used by online merchants to accept cryptocy payments through WordPress and WooCommerce. The vulnerability carries a maximum CVSS severity score of 10.0, making it one of the most dangerous classifications for a software security flaw. Cybersecurity firm AVES Netsec, through its Defused threat detection network, confirmed on November 2 that hackers were actively attempting to exploit the vulnerability. With no security patch currently available, researchers are urging website operators to remove the affected plugin immediately and replace potentially compromised wallet credentials.
On November 2, Defused, the threat intelligence division of cybersecurity company AVES Netsec, reported observing real-world exploitation attempts targeting the CryptoPayment Gateway plugin.
The activity was detected through the company’s deception network, which operates specially configured systems designed to identify and monitor malicious cyberattacks.
According to researchers, the attacks originated from infrastructure advertised as anonymous, Know Your Customer (KYC)-free virtual private server hosting, a type of service that can make identifying malicious operators more difficult.
The vulnerability was originally disclosed in September 2026 but had not previously been publicly documented as actively exploited.
The latest findings confirm that hackers are now attempting to take advantage of the security weakness, potentially placing cryptocy merchants and their customers at risk.
Although active exploitation attempts have been observed, researchers have not confirmed how many websites have been successfully compromised or whether cryptocy funds have been stolen through the vulnerability.
The vulnerability, officially tracked as CVE-2026-81648, results from a missing authorization check within the plugin’s AJAX endpoint, which processes certain requests between a WordPress website and its server.
Normally, administrative operations involving sensitive payment settings should require appropriate authentication and authorization.
However, the affected CryptoPayment Gateway versions fail to verify whether users requesting certain administrative actions have permission to perform them.
This security weakness allows an unauthenticated attacker to potentially access sensitive information and manipulate website settings without logging into the WordPress administration dashboard.
According to the vulnerability disclosure, successful exploitation could allow attackers to:
Steal cryptocy wallet credentials stored in readable, unencrypted form.
Modify payment gateway settings, potentially redirecting cryptocy payments to attacker-controlled wallets.
Delete arbitrary files from the affected WordPress server, disrupting website functionality or damaging stored information.
Access sensitive payment configurations without administrator authorization.
The vulnerability affects CryptoPayment Gateway versions 1.2.1 through 1.2.2, with version 1.2.2 remaining the latest available release.
Security researcher Pedro Pinho is credited with discovering the vulnerability, while WPScan coordinated its disclosure on September 13, 2026.
The maximum 10.0 CVSS rating reflects the seriousness of the flaw, particularly because attackers do not need valid login credentials to exploit it.
CryptoPayment Gateway is a WooCommerce extension designed to help online businesses accept cryptocy payments directly through their WordPress websites.
WooCommerce is one of the most widely used e-commerce platforms for WordPress, allowing merchants to create online stores, manage products and process customer transactions.
The affected payment plugin supports several digital currencies, including Bitcoin (BTC), Bitcoin Cash (BCH), Litecoin (LTC) and Dogecoin (DOGE).
To configure the payment gateway, merchants enter cryptocy wallet information into the plugin’s settings.
However, the security vulnerability could expose sensitive credentials stored within those configurations.
Unlike conventional payment processors, cryptocy transactions generally cannot be reversed once confirmed on a blockchain.
This means that if attackers successfully redirect payments to wallets they control, recovering the stolen funds could become extremely difficult.
The vulnerability is particularly concerning for smaller businesses that rely on third-party WordPress plugins to integrate cryptocy payments without developing their own payment infrastructure.
One of the most alarming aspects of the vulnerability is that no patched version of CryptoPayment Gateway has been released.
According to security researchers, the plugin was removed from the official WordPress Plugin Directory on August 28, 2026, following an unspecified security issue.
Despite its removal, websites that previously installed the plugin may still contain vulnerable files.
Security researcher Ondrej Simaisch warned that certain aspects of the vulnerability could remain exploitable even when the plugin has been deactivated but not completely removed from a website.
This means simply disabling the plugin through the WordPress dashboard may not provide sufficient protection.
Researchers recommend several immediate security measures:
Remove the CryptoPayment Gateway plugin entirely, including installations that are currently inactive.
Rotate potentially exposed wallet credentials and private keys, replacing them with newly generated credentials where applicable.
Review cryptocy payment addresses to identify unauthorized changes or suspicious wallet destinations.
Inspect website logs and payment configurations for evidence of unauthorized access or file modifications.
Review previous cryptocy transactions for payments that may have been redirected.
Website administrators should also maintain secure backups and verify that any replacement cryptocy payment solution receives regular security updates.
Removing the vulnerable plugin prevents further exploitation through its installed files, but it does not automatically invalidate credentials that attackers may have already obtained.
Although CryptoPayment Gateway does not have the same widespread adoption as larger WordPress payment extensions, cybersecurity experts warn that its limited user base does not reduce the seriousness of the vulnerability.
According to publicly available plugin statistics cited by security researchers, CryptoPayment Gateway had accumulated approximately 1,845 downloads, although the number of active installations remains unclear.
Even a relatively small number of compromised websites could result in significant financial losses if attackers obtain access to cryptocy wallet credentials or redirect customer payments.
The situation also highlights a broader challenge within the WordPress ecosystem, where merchants frequently depend on third-party extensions to provide specialized financial services.
Unlike traditional software platforms that maintain centralized control over their payment infrastructure, WordPress website owners are responsible for managing their installed plugins and monitoring security updates.
When a plugin developer stops maintaining a product or fails to release critical security patches, merchants may unknowingly continue operating vulnerable systems.
For cryptocy businesses, the consequences can be particularly severe because compromised wallet credentials may expose assets beyond the website’s immediate payment-processing operations.
The discovery of active exploitation attempts against CryptoPayment Gateway underscores the increasing cybersecurity risks facing businesses that integrate cryptocy payments into traditional e-commerce platforms.
As digital asset adoption expands, cybercriminals are targeting not only major exchanges and decentralized finance protocols but also smaller businesses that depend on third-party software.
The incident demonstrates how a single missing authorization check can expose sensitive financial information and potentially compromise an entire payment system.
It also raises important questions about the security practices of cryptocy payment providers, particularly regarding the storage of private keys, administrative permissions and sensitive wallet credentials.
For WordPress merchants accepting cryptocy, the immediate priority is determining whether the affected CryptoPayment Gateway plugin has ever been installed and ensuring that any exposed credentials are replaced.
The broader lesson for the cryptocy industry is that secure blockchain networks alone cannot protect digital assets when the software connecting users and businesses to those networks contains critical vulnerabilities.
As attackers continue searching for weaknesses in cryptocy payment infrastructure, regular security audits, properly maintained plugins and stronger credential management will remain essential to protecting businesses and their customers.
Apple, Home Depot, Boeing and ServiceNow have joined a growing group of major U.S. corporations…
House Democrats are reportedly preparing a new cryptocy market structure bill following their victories in…
Binance has released its first detailed investigation into the massive $6.34 billion cryptocy hack on…
Brazilian cryptocy exchange Mercado Bitcoin is facing increased scrutiny after blockchain investigators discovered that hackers…
Solana Labs has officially launched Leap, a new mobile trading application that allows users to…
Morgan Stanley has become one of the first major U.S. banks to tokenize traditional financial…