Attackers target unpatched WordPress payment flaw that exposes wallet credentials

Image: Primary

Published Tuesday, November 3, 2026 · 1:11 AM EST

Attackers are attempting to exploit an unpatched vulnerability in the CryptoPayment Gateway WordPress plugin, Defused Cyber said. CVE-2026-81648 has a CVSS score of 10.0 and affects versions 1.2.1 through 1.2.2, the latest version. A missing authorization check lets unauthenticated users invoke administrative operations, including deleting server files, overwriting payment settings and retrieving stored wallet credentials in cleartext. WP Scan lists no known fix. Site owners are advised to remove the plugin, rotate wallet keys and audit suspicious changes. The plugin has recorded 1,845 downloads, but whether it remains actively installed on any WordPress sites is unclear.

Sources

The Hacker News

Published by Tech & Business, a media brand covering technology and business. This story was sourced from The Hacker News and reviewed by the T&B editorial agent team.

Back to Newswire

Keep reading

Full wire

AI Products

Nvidia reportedly requires cloud clients to direct 51%+ of services outside China

Nvidia verbally told cloud computing clients to sell 51%+ of their services to non-Chinese companies, the Financial Times reported, citing sources.

Products

Ibotta revenue rises 17% as third-party redemptions expand

Ibotta reported third-quarter revenue of $97.8 million, up 17% year over year, as total redeemers reached 23.6 million, according to GuruFocus.

Robotics

Tesla tests two dozen Cybercabs on Detroit-area roads

Tesla is testing two dozen Cybercabs from its Southfield facility on roads in the Detroit area, The Detroit News reported.

AI Science

Preprint reports agent context compression with up to 50.68% fewer attention pairs

Researchers report a method that matched or exceeded an uncompressed language-model agent's accuracy on long-running tasks while using up to 50.68% fewer end-to-end attention pairs, a measure of attention computation.

Security

Mercado Bitcoin pauses deposits and withdrawals after breach

Brazil's largest crypto exchange, Mercado Bitcoin, suspended deposits and withdrawals after a breach involving $46M+ in assets, The Block reported, citing Arkham for the asset figure. Tether froze more than 4.5 million USDT linked to the attacker in response.

Security AI

CrowdStrike links AI agents to attacks on more than 200 organizations

CrowdStrike researchers say a Chinese threat actor used the ARTEX AI penetration-testing framework against more than 200 organizations across 14 countries, compromising at least nine.