Search — “CVE-2026-81648”

Defused Cyber reports in-the-wild exploitation attempts against CVE-2026-81648, a CVSS 10.0 unauthenticated authorization flaw in the CryptoPayment Gateway WordPress plugin, versions 1.2.1 through 1.2.2, which has no known fix and was closed on the WordPress Plugin Directory. The flaw is an unauthorized AJAX endpoint that allows deleting arbitrary files, overwriting the payment gateway configuration, and recovering stored wallet credentials in cleartext. The attack traffic reportedly came from infrastructure marketing itself as 'Anonymous KYC-Free VPS Hosting', but the sources do not print specific indicators or log patterns. Site owners are advised to remove the plugin, rotate wallet keys, and audit for suspicious changes.

Threat actors are attempting to exploit CVE-2026-81648, a CVSS 10.0 unauthenticated authorization-bypass flaw in the CryptoPayment Gateway WordPress plugin versions 1.2.1 through 1.2.2, according to Defused Cyber. The flaw lets unauthenticated users invoke administrative AJAX operations such as arbitrary file deletion and recovery of stored wallet credentials in cleartext, and no fix is available. Defused Cyber observed attempts originating from infrastructure marketed as 'Anonymous KYC-Free VPS Hosting'; hunters should look for unauthenticated admin-ajax requests to the plugin's endpoint and unexpected file deletions or gateway configuration changes.