The CryptoPayment Gateway WordPress plugin has a maximum-severity authorization bug and, as of this week, no patched release. Attackers are already attempting to exploit it.
What happened
One of the plugin's AJAX endpoints performs no authorization check. That lets an unauthenticated visitor invoke administrative operations: deleting arbitrary files on the server, overwriting the payment gateway configuration, and pulling stored wallet credentials out in cleartext. The flaw is tracked as CVE-2026-81648 and rated CVSS 10.0.
The vulnerable range is 1.2.1 through 1.2.2, and 1.2.2 is the latest release, so there is nothing to upgrade to. Defused Cyber says exploit attempts against the unpatched plugin are already being observed.
Who is affected
- Any WordPress site running CryptoPayment Gateway 1.2.1 or 1.2.2
- Shops that accept crypto payments through the plugin, since wallet credentials are the prize
- Sites where the plugin folder remains installed but deactivated is not automatically safe - removal is the stronger position
What to do now
Deactivate and delete the plugin today, and rotate any wallet key or seed that was ever stored in its settings.
- Deactivate the plugin from the WordPress admin, then delete it rather than leaving it dormant on disk
- Change the wallet address and keys the site was using, and move funds off any wallet whose key touched the plugin
- Check the web root for unexpected files, especially recently modified PHP
- Review the site's payment settings for the overwrite the flaw allows
- If you must keep accepting crypto, use a gateway that does not store keys on the WordPress host at all
What this means for South African businesses
Plugin vulnerabilities are the most common way a small South African business website gets taken over, and an unpatched one is worse than a vulnerable one because there is no remediation date to wait for. Most sites running a crypto payment plugin will have installed it once, taken a few payments, and forgotten it - a dormant plugin is still executable code, so it counts. The practical judgement here is that the number of local sites genuinely dependent on this specific plugin is small, but the number that have it sitting unused in wp-content/plugins is not zero, and that is who gets hit.
Source
Reported by The Hacker News; the flaw record is the WPScan-assigned CVE entry.