---
title: Unpatched CryptoPayment Gateway WordPress plugin (CVE-2026-81648, CVSS 10) is drawing exploitation attempts that could read wallet credentials in cleartext or delete wp-config.php | ctxsec
url: https://ctxsec.com/items/cryptopayment-gateway-wordpress-cve-2026-81648-exploitation-attempts-no-patch
description: "Deception-network operator Defused said on Nov 2 it is seeing in-the-wild exploitation attempts against CVE-2026-81648 in the CryptoPayment Gateway plugin for WordPress, versions 1.2.1\u20131.2.2. A raw PHP endpoint in the plugin has no authorization check, so anyone can read or overwrite the gateway settings, have the plugin decrypt stored wallet keys, or delete arbitrary files. There is no fixed version and the plugin was removed from the WordPress directory on Aug 28. Its install base is small, but any site that still has it is exposed."
status: "official (WPScan/NVD advisory; Defused exploitation-attempt report on X, Nov 2). No fix exists; the plugin was closed in the WordPress directory on Aug 28"
published: 2026-11-03
---

> Deception-network operator Defused said on Nov 2 it is seeing in-the-wild exploitation attempts against CVE-2026-81648 in the CryptoPayment Gateway plugin for WordPress, versions 1.2.1–1.2.2. A raw PHP endpoint in the plugin has no authorization check, so anyone can read or overwrite the gateway settings, have the plugin decrypt stored wallet keys, or delete arbitrary files. There is no fixed version and the plugin was removed from the WordPress directory on Aug 28. Its install base is small, but any site that still has it is exposed.

[← Cybersecurity News](/news) · [markdown](/items/cryptopayment-gateway-wordpress-cve-2026-81648-exploitation-attempts-no-patch.md)

official (WPScan/NVD advisory; Defused exploitation-attempt report on X, Nov 2). No fix exists; the plugin was closed in the WordPress directory on Aug 28

2026-11-03

### Unpatched CryptoPayment Gateway WordPress plugin (CVE-2026-81648, CVSS 10) is drawing exploitation attempts that could read wallet credentials in cleartext or delete wp-config.php

- **Vulnerable endpoint (WPScan):** `wp-content/plugins/cryptopayment-gateway/vendor/cryptd/ajax.php`, POST `data` JSON with functions `get-settings`, `save-settings`, `encryption` and `delete-file` (path traversal). The file-delete bug works even if the plugin was never activated, as long as its files are on disk.
- **Hunt:** POSTs to `/vendor/cryptd/ajax.php` or `/vendor/cryptd/upload.php` in web logs; wallet addresses in the gateway settings that don't match your records; a site suddenly redirecting to `/wp-admin/setup-config.php`, which means wp-config.php was deleted.

**What to do:** delete the plugin directory entirely (deactivating is not enough), block the path at the WAF, move funds and rotate any wallet key that was ever stored in it, and check payout addresses.

Sources: [WPScan: CryptoPayment Gateway 1.2.1–1.2.2 unauthenticated arbitrary file deletion and settings update (CVE-2026-81648)](https://wpscan.com/vulnerability/9b1490a0-1381-4d22-8086-f75aade4e898/) · [Defused on X: in-the-wild exploitation attempts (Nov 2)](https://x.com/DefusedCyber/status/2117325160608870613) · [The Hacker News: Attackers target unpatched CryptoPayment Gateway flaw](https://thehackernews.com/2026/11/attackers-target-unpatched.html)