> ## Content Index
> Fetch the complete content index at: https://stackurity.ai/blog/llms.txt
> Use this file to discover other available public pages before exploring further.

# CryptoPayment Gateway plugin flaw CVE-2026-81648 is targeted
- URL: https://stackurity.ai/blog/cryptopayment-gateway-cve-2026-81648-wordpress-plugin/
- Published: 2026-11-04T03:35:04.000Z
- Updated: 2026-11-04T03:35:04.000Z
- Description: Attackers target unpatched CVE-2026-81648 in the CryptoPayment Gateway WordPress plugin. See the affected versions and what to do now.
- Author: Stackurity Research Team
- Tags: Actively Exploited, News

**TL;DR:** Attackers are trying to exploit CVE-2026-81648 in the CryptoPayment Gateway WordPress plugin, which has no fix yet. If you run it, take it offline until the vendor ships one.

## What happened

[The Hacker News reported](https://thehackernews.com/2026/11/attackers-target-unpatched.html) on November 3, 2026, citing Defused Cyber, that attackers are probing a flaw with no patch in the CryptoPayment Gateway plugin for WordPress. The [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-81648) says releases 1.2.1 through 1.2.2 skip an authorization check on an AJAX endpoint. Unauthenticated users can then run administrative actions, including deleting files, overwriting the payment configuration and reading stored wallet credentials in cleartext. It has a CVSS v3.1 score of 10 from WPScan.

## Am I affected?

You are affected if the plugin is installed at version 1.2.1 or 1.2.2\. In the WordPress admin, open the plugin list and read the version. With the command line, `wp plugin list` shows the same. No fixed version is given in the sources we reviewed, so check the plugin vendor's advisory, deactivate the plugin meanwhile, and treat any wallet credentials it stored as exposed.

## How to check with Stackurity

Stackurity finds WordPress sites as applications and lists plugins and themes with their latest release from wordpress.org, but it does not match the vulnerabilities of plugins yet. It will not flag this CVE, so use the manual check above (see [how fixes are tracked](https://stackurity.ai/docs/remediation) in the docs). For the wider picture, see our earlier post on a [WordPress core flaw under attack](https://stackurity.ai/blog/wordpress-race-condition-rce-attempted-exploitation/). Stackurity Cloud has a 14-day free trial without a card: [start a free trial](https://app.stackurity.dev/signup?utm%5Fsource=blog&utm%5Fmedium=referral&utm%5Fcampaign=actively-exploited&utm%5Fcontent=cryptopayment-gateway-cve-2026-81648-wordpress-plugin).