CryptoPayment Gateway plugin flaw CVE-2026-81648 is targeted
Attackers target unpatched CVE-2026-81648 in the CryptoPayment Gateway WordPress plugin. See the affected versions and what to do now.
TL;DR: Attackers are trying to exploit CVE-2026-81648 in the CryptoPayment Gateway WordPress plugin, which has no fix yet. If you run it, take it offline until the vendor ships one.
What happened
The Hacker News reported on November 3, 2026, citing Defused Cyber, that attackers are probing a flaw with no patch in the CryptoPayment Gateway plugin for WordPress. The NVD entry says releases 1.2.1 through 1.2.2 skip an authorization check on an AJAX endpoint. Unauthenticated users can then run administrative actions, including deleting files, overwriting the payment configuration and reading stored wallet credentials in cleartext. It has a CVSS v3.1 score of 10 from WPScan.
Am I affected?
You are affected if the plugin is installed at version 1.2.1 or 1.2.2. In the WordPress admin, open the plugin list and read the version. With the command line, wp plugin list shows the same. No fixed version is given in the sources we reviewed, so check the plugin vendor's advisory, deactivate the plugin meanwhile, and treat any wallet credentials it stored as exposed.
How to check with Stackurity
Stackurity finds WordPress sites as applications and lists plugins and themes with their latest release from wordpress.org, but it does not match the vulnerabilities of plugins yet. It will not flag this CVE, so use the manual check above (see how fixes are tracked in the docs). For the wider picture, see our earlier post on a WordPress core flaw under attack. Stackurity Cloud has a 14-day free trial without a card: start a free trial.
