Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials

Threat actors are actively attempting to exploit a critical unpatched vulnerability (CVE-2026-81648) in the CryptoPayment Gateway WordPress plugin, which carries a maximum CVSS score of 10.0. The flaw allows unauthenticated users to delete arbitrary files on the server and extract sensitive wallet credentials. The vulnerability has not yet been patched, making all installations potentially at risk. Findings were reported by Defused Cyber. The exploitation of this flaw could lead to significant financial losses given the cryptocurrency payment context. The combination of file deletion and credential extraction capabilities makes this a severe threat to affected site owners.