What Happened
Threat actors are attempting to exploit the unpatched CryptoPayment Gateway vulnerability, a maximum-severity flaw in the CryptoPayment Gateway WordPress plugin, according to findings from Defused Cyber. The issue is tracked as CVE-2026-81648 and carries a CVSS score of 10.0. Successful exploitation could let unauthenticated users delete arbitrary files on the server and extract wallet credentials.
For an MSP, this is the kind of issue that shows up on a client site weeks after the initial access. The plugin handles payment data and credentials, so the risk isn't just a broken page. It's money movement and access. That makes it worth checking today.
Timeline
- 2026-11-03T05:34:37+00:00: Attempts to exploit CVE-2026-81648 in the CryptoPayment Gateway WordPress plugin are reported.
Who Is Affected
The affected product is the CryptoPayment Gateway WordPress plugin. Any WordPress site with that plugin installed and active is the exposure. For MSPs, that means client sites, your own site, or any staging site that mirrors a production environment.
Because the flaw lets an unauthenticated user act on the server, the risk is not limited to sites that actively process payments. A site with the plugin installed but not actively used can still be a target.
Why the CryptoPayment Gateway Vulnerability Matters
A crypto payment gateway, in general, lets a WordPress site accept cryptocurrency payments. It typically handles wallet addresses, private keys, API credentials, and payment records. A flaw that exposes those pieces turns a payment plugin into a credential theft risk.
Unauthenticated file deletion is its own problem. If an attacker can remove arbitrary files from the server, they can break the site, remove files that protect other data, or make a clean recovery harder. The two effects together make this a critical issue for any environment that has the plugin.
Technical Details
The vulnerability is CVE-2026-81648 in the CryptoPayment Gateway WordPress plugin. It has a CVSS score of 10.0. Defused Cyber's findings state that successful exploitation could permit unauthenticated users to delete arbitrary files on the server and extract wallet credentials. The finding does not name specific affected versions.
The plugin is unpatched, so treat any installation as exposed until a fixed version is released and confirmed.
What to Do This Week
The following steps are the sensible starting point for any WordPress environment facing an unpatched plugin issue. Apply them to every site you manage.
- Inventory all WordPress sites under your management and list every active plugin. Flag any site running CryptoPayment Gateway.
- If you find the plugin, check whether it is actually needed. If the site does not use crypto payments, remove it and take a backup of the site files and database.
- For sites that need the plugin, isolate them where possible. Block external access to the WordPress admin area, put the site behind IP allowlists, and increase logging so you can see odd requests.
- Rotate any wallet credentials, private keys, API keys, or database credentials that the plugin could have touched. Do this even if you see no sign of compromise, because unauthenticated file access is hard to spot after the fact.
- Review file permissions on the web root and wp-content directories. Make sure the web server user cannot write to files outside the folders it needs.
- Check rewrite rules, wp-config.php, and recently modified files for signs of tampering. A file deletion flaw is often used with other techniques to plant backdoors.
- Watch the plugin vendor's channel for a security release. There is no patch mentioned in the published finding, so a fix may take time. Plan for the plugin to stay offline until that release exists.
What to Tell Clients
"There is a known attack against a WordPress payment plugin called CryptoPayment Gateway. The plugin has a serious flaw with no patch yet, and attackers are already trying to use it. We are checking every site you have with us."
"If we find this plugin, we will remove it or take it offline until the vendor fixes it. You may see a payment option disappear for a while. That is intentional and temporary."
"We will also rotate the credentials tied to the plugin, including wallet keys if your site uses them. Please do not change those settings yourself until we finish the check, because we need to see the current state before we clean it."
"If you have used this plugin with a client site or an external party, let us know. We want to confirm no other site is exposed."
Frequently Asked Questions
What Is CVE-2026-81648?
CVE-2026-81648 is a maximum-severity vulnerability in the CryptoPayment Gateway WordPress plugin. It has a CVSS score of 10.0. According to Defused Cyber, successful exploitation could let unauthenticated users delete arbitrary files on the server and extract wallet credentials.
Is There a Patch for the CryptoPayment Gateway Vulnerability?
The published finding does not mention a fixed version. The plugin is unpatched, so treat any installation as exposed until the vendor releases a security update and you confirm the version on the site is safe.
How Do I Know If My WordPress Site Is Affected?
Check the list of installed plugins in wp-admin, or use WP-CLI to list plugins across the sites you manage. The risk is tied to the CryptoPayment Gateway plugin being installed, whether or not it is actively processing payments. If you find it, include it in your immediate response.
Should I Disable the Plugin If the Site Does Not Need It?
Yes. If the site is not using crypto payments, remove the plugin and take a backup of the site files and database. If the site needs it, restrict access to the admin area and watch the logs until a patch is available.
What Should I Do With Wallet Credentials?
Rotate wallet private keys, API keys, and any credentials the plugin could access, even if there is no sign of compromise. Unauthenticated file deletion is hard to detect after it happens, and this plugin is already being targeted. Treat the credentials as potentially exposed.
Can the Plugin Be on a Site Without IT Knowing About It?
It can, if it was installed by a previous provider, added by a site owner, or bundled as part of another plugin. That is why the first step is a complete inventory of active plugins on every WordPress site you manage.