A critical flaw in the CryptoPayment Gateway plugin for WordPress lets anyone read and overwrite its payment settings without logging in, including stored wallet credentials. It is tracked as CVE-2026-81648, it has the maximum severity score of 10.0, and no fix is known. Security researchers reported attempts to exploit it on 3 November. If your store runs this plugin, remove it and treat any wallet key it held as stolen.
What happened?
The security database WPScan published the flaw on 10 September 2026. It affects versions 1.2.1 and 1.2.2, the newest version available. One of the plugin's web endpoints has no permission check, so a request from anyone is accepted. WPScan's proof of concept shows three results:
- Reading the settings. The wallet key comes back encrypted, but the plugin's own decryption function can also be called without logging in, which reveals it.
- Changing the settings, including wallet addresses and keys.
- Deleting files on the server. Deleting
wp-config.phpsends the site back to its installer, which can open the way to a full takeover.
WordPress.org had already closed the plugin on 28 August 2026, giving "Security Issue" as the reason. It can't be downloaded from there any more, and closing a plugin doesn't remove it from sites where it's installed. Neither the closure notice nor the reports we read connect that closure to this CVE by name.
Is it being exploited?
Attempts have been reported, but no thefts. On 3 November, Daily Security Review and SecurityLab both reported that the security firm Defused Cyber had seen exploitation attempts. Both stress that these are attempts: neither reports a confirmed loss of funds or a number of affected stores. We didn't see Defused's own post.
The official records are more cautious. A US Cybersecurity and Infrastructure Security Agency (CISA) assessment added to the record on 3 November lists a public proof of concept and says the attack can be automated, and the CVE isn't in CISA's Known Exploited Vulnerabilities list. The plugin's reach also looks small: those reports give 1,845 total downloads, and downloads don't equal live stores.
What this means for merchants
Most stores don't use this plugin, so the direct risk is narrow. For a store that does, it's serious, because the plugin keeps wallet credentials on the web server. A person who gets those credentials can spend from the wallet, and a person who changes the settings can send future payments to their own address, with nothing looking wrong at checkout until the money fails to arrive.
The wider point applies to any store with any payment plugin. A plugin runs with access to your site, and a plugin closed in the WordPress directory no longer gets updates through it.
Crypto Merchant doesn't offer a WordPress plugin and has no connection to this one.
What should you do?
- 1Check your plugins. Look for "CryptoPayment Gateway" (folder
wp-content/plugins/cryptopayment-gateway) in versions 1.2.1 or 1.2.2. A normal WordPress update won't fix it. - 2If you have it, remove it. Don't wait for a patch, since none is known.
- 3Treat its wallet as compromised. Move the funds to a new wallet whose key has never been on that server, and change any API keys the plugin held. Changing the settings isn't enough if the key may already have been copied.
- 4Check what changed. Compare the receiving addresses against your own records, look through recent orders for payments you never received, and check your server logs and files for missing or altered items. Restore from a clean backup if you find any.
- 5Review your other plugins. On each plugin's WordPress.org page, look for a closure notice, and remove anything closed or abandoned that touches payments. Be wary of any plugin that asks you to paste in a wallet's private key or recovery phrase.
Sources
- CryptoPayment Gateway 1.2.1 - 1.2.2 - Unauthenticated Arbitrary File Deletion and Settings Update via Unguarded AJAX Router, WPScan, 10 September 2026
- CryptoPayment Gateway plugin page (closure notice), WordPress.org, closed 28 August 2026
- Unpatched CVSS 10.0 CryptoPayment Gateway Plugin Flaw Under Attack, Daily Security Review, 3 November 2026
- Report on exploitation attempts (in Russian), SecurityLab, 3 November 2026
- CVE-2026-81648, with the CISA assessment, OpenCVE, modified 3 November 2026