Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials

As cited

Copy frozen at 2026-11-03 07:31 UTC (site build).

vulnerabilities

Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials

Threat actors are exploiting an unpatched critical vulnerability in the CryptoPayment Gateway WordPress plugin tracked as CVE-2026-81648, which carries a CVSS score of 10.0. The flaw permits unauthenticated users to delete arbitrary files and extract sensitive data, including wallet credentials.

Why it matters: WordPress site operators running the CryptoPayment Gateway plugin face immediate risk of credential theft and data loss; patching or disabling the plugin is urgent.

Source published

2026-11-03 05:34 UTC

First seen by Cybersecurity Tracker

2026-11-03 06:55 UTC