Defused Cyber says it observed in-the-wild exploitation attempts against CVE-2026-81648, a CVSS 10.0 vulnerability in the CryptoPayment Gateway WordPress plugin. The attacks came from infrastructure advertising anonymous, KYC-free VPS hosting, according to Defused Cyber’s disclosure.
The flaw allows unauthenticated users to read stored payment-gateway settings, including wallet credentials held in cleartext, and overwrite the configuration, Defused Cyber said. The disclosure establishes attempted exploitation, but does not confirm that a particular site was compromised or that credentials were successfully stolen.
Versions 1.2.1 through 1.2.2 are affected, with 1.2.2 identified as the latest version. The Hacker News reports that the vulnerability also permits arbitrary file deletion and that no known fix was available. It further reports that the plugin was closed in the WordPress Plugin Directory on August 28, 2026, over an unspecified security issue (The Hacker News report).
The Hacker News says site owners were advised to remove the plugin, rotate wallet keys and audit for suspicious changes (reported defensive guidance). That is reported guidance, not an identified official patched response. The available sources do not identify a fixed release, confirm the number of affected installations or establish confirmed compromises.
Administrators should distinguish the reported activity from the potential impact: exploitation attempts have been observed, while the flaw could enable credential exposure, configuration tampering and arbitrary file deletion. The plugin’s reported download count does not establish how many sites currently run it.