# Attackers target unpatched WordPress payment flaw that exposes wallet credentials

_Published Tuesday, November 3, 2026 at 1:11 AM EST · Security · Latest · Tier 2 — Notable_

![Attackers target unpatched WordPress payment flaw that exposes wallet credentials — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj1tflB6yfzJv3UijqJlfCikzOQx0NHz9AVTh13vDvWu-LfAfFfBDjGbKI79Cb3dd2Ca_ck2KNP46WwYKcuweVD9Wc1srFpRkBimsG-EQS567tR92Yyg1DKPWqhhZHc1sP71qHWQoUxndY2VzDlqVsd2gx2GPcMx7pjVG8ws13bfMKXDtqz5q7EiJ22Mmr_/s1700-nu-rw-lo-l85-e365/wp.jpg)

Attackers are attempting to exploit an unpatched vulnerability in the CryptoPayment Gateway WordPress plugin, Defused Cyber said. CVE-2026-81648 has a CVSS score of 10.0 and affects versions 1.2.1 through 1.2.2, the latest version.

A missing authorization check lets unauthenticated users invoke administrative operations, including deleting server files, overwriting payment settings and retrieving stored wallet credentials in cleartext. WP Scan lists no known fix. Site owners are advised to remove the plugin, rotate wallet keys and audit suspicious changes.

The plugin has recorded 1,845 downloads, but whether it remains actively installed on any WordPress sites is unclear.

## Sources

- [The Hacker News](https://thehackernews.com/2026/11/attackers-target-unpatched.html)

---
Canonical: https://techandbusiness.org/newswire/wtLEB2W96UyDWS-zBydo7d
Published: 2026-11-03T06:11:57.522Z
Story chronology: 2026-11-03T05:34:00.000Z
Retrieved: 2026-11-03T08:33:50.591Z
Publisher: Tech & Business (techandbusiness.org)