Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials
Summary
Threat actors are actively attempting to exploit a critical, unpatched vulnerability in the CryptoPayment Gateway WordPress plugin, identified as CVE-2026-81648. Successful exploitation of this flaw could allow unauthenticated users to delete arbitrary files on the server and expose wallet credentials.
IFF Assessment
This vulnerability allows attackers to delete arbitrary files and expose sensitive wallet credentials, posing a significant risk to users and their assets.
Severity
Defender Context
This highlights the ongoing risk posed by unpatched vulnerabilities in popular WordPress plugins, especially those handling financial transactions. Defenders should prioritize patching this specific vulnerability and maintaining an up-to-date inventory of all plugins and their security status. Regularly monitoring for new exploit attempts against known critical flaws is also essential.