[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Cybersecurity News · markdown

official (WPScan/NVD advisory; Defused exploitation-attempt report on X, Nov 2). No fix exists; the plugin was closed in the WordPress directory on Aug 28

Unpatched CryptoPayment Gateway WordPress plugin (CVE-2026-81648, CVSS 10) is drawing exploitation attempts that could read wallet credentials in cleartext or delete wp-config.php

  • Vulnerable endpoint (WPScan): wp-content/plugins/cryptopayment-gateway/vendor/cryptd/ajax.php, POST data JSON with functions get-settings, save-settings, encryption and delete-file (path traversal). The file-delete bug works even if the plugin was never activated, as long as its files are on disk.
  • Hunt: POSTs to /vendor/cryptd/ajax.php or /vendor/cryptd/upload.php in web logs; wallet addresses in the gateway settings that don't match your records; a site suddenly redirecting to /wp-admin/setup-config.php, which means wp-config.php was deleted.

What to do: delete the plugin directory entirely (deactivating is not enough), block the path at the WAF, move funds and rotate any wallet key that was ever stored in it, and check payout addresses.

Sources: WPScan: CryptoPayment Gateway 1.2.1–1.2.2 unauthenticated arbitrary file deletion and settings update (CVE-2026-81648) · Defused on X: in-the-wild exploitation attempts (Nov 2) · The Hacker News: Attackers target unpatched CryptoPayment Gateway flaw