Some WordPress plugin vulnerabilities need a clever chain of conditions. A specific role, a particular setting, a user who clicks something they should not.

This one needs a request. That is the entire prerequisite.

CVE-2026-81648 scores 10.0 out of 10.0 on the CVSS scale, it lives in the CryptoPayment Gateway plugin, and there is no fix. Not a workaround, not a patch, not a beta. Nothing. The plugin has been pulled from the WordPress Plugin Directory entirely.

Defused Cyber is already seeing exploitation attempts in the wild.

What the Endpoint Actually Exposes

The NIST National Vulnerability Database description lays it out without hedging. The plugin, in versions 1.2.1 through 1.2.2, does not apply an authorization check on one of its AJAX endpoints. Unauthenticated users can invoke administrative operations.

Those operations are not cosmetic.

The third one is where the real damage lives. The plugin stores wallet credentials. The vulnerability exposes them as plaintext to anyone who reaches the endpoint. No decryption, no cracking, no privilege escalation needed.

The Attack Infrastructure

Defused Cyber's description of the source infrastructure is worth noting, because it tells you who is doing this.

The recorded attempts came from hosting that advertises itself as "Anonymous KYC-Free VPS Hosting." That is not a signature of a state actor or an APT. That is commodity criminal infrastructure, sold openly, designed to be purchased without identity verification.

Which means the barrier to entry for this exploit is essentially zero. Anyone who reads Defused Cyber's post and finds the plugin on a target list can run the same attack.

The Download Numbers and What They Mean

The plugin has been downloaded 1,845 times in total. Twenty of those downloads happened in the last seven days, which suggests it is still being pulled down somewhere, possibly by people who have not seen the advisory.

Whether it is actively installed on any live WordPress site is unclear. But 1,845 downloads is not nothing. Somewhere in that number, there are sites running this plugin right now.

As of August 28, 2026, the plugin was closed on the WordPress Plugin Directory. The stated reason was an unspecified "security issue," which in the plugin ecosystem means the team pulled it because someone reported a critical problem.

The Remediation Steps

There is no patch. WP Scan confirms it. So the remediation is removal, followed by cleanup.

• Delete the plugin, don't just deactivate it. Deactivating leaves files on disk. The AJAX endpoint may still be reachable. Deactivate, then delete the plugin folder entirely.
• Rotate every wallet key and credential. Assume they were exposed. In case the plugin ever started receiving payments, then generate new addresses for moving the payments.
• Check whether the settings of the plugin have been changed since that might be the reason why the payments could have been redirected. Reconcile your transaction records against what actually arrived in your wallet.
• Audit for unauthorized changes. New admin accounts, modified files, unexpected cron jobs, altered .htaccess rules. Look for anything you did not do.
• Review server logs for AJAX requests. Unauthenticated POST requests to the plugin's handler, especially from IP ranges tied to anonymous VPS hosting, are the signature of an attempt.
• Scan for web shells. If an attacker had arbitrary file deletion, they may have also planted something. Run a full malware scan and review recently modified PHP files.

Why This One Is Worse Than the CVSS Score Suggests

A 10.0 is already the maximum. But the nature of this flaw makes it worse than the number implies.

Most maximum-severity vulnerabilities require some level of access, some configuration, or some user interaction. This one requires a single unauthenticated HTTP request.

And the payload is not abstract. It is a crypto wallet. Funds that leave are gone. There is no chargeback, no fraud department, no recovery process.

That combination is rare. A perfect score, no authentication, and a direct financial loss vector, all in a plugin that stores the keys to the money.

The Pattern Worth Noticing

This is not an isolated case. Small WordPress plugins that handle sensitive functionality, maintained by small teams or abandoned entirely, are a recurring source of critical vulnerabilities with no patch path.

The plugin directory is not a security guarantee. Being listed there meant nothing for this plugin's users, and the listing disappeared once the problem became known.

For site owners, the takeaway is uncomfortable. A plugin's download count, its star rating, and its directory listing tell you nothing about whether anyone is reviewing its code for authorization checks. That scrutiny has to come from somewhere, and usually it does not.

FAQ

What is CVE-2026-81648?

A maximum-severity vulnerability in the CryptoPayment Gateway WordPress plugin. It lets users without any authentication carry out administrative actions via an unprotected AJAX endpoint, such as deleting files, altering payment settings, and reading credentials stored in cleartext.

Which versions are affected?

Versions 1.2.1 through 1.2.2. That is the full affected range, and 1.2.2 is the latest release.

Is there a patch?

No. WP Scan confirms there is no known fix. The plugin has been closed on the WordPress Plugin Directory since August 28, 2026.

Has this been exploited?

Yes. Defused Cyber reported observing in-the-wild exploitation attempts, originating from infrastructure marketed as anonymous, KYC-free VPS hosting.

What should I do if I have the plugin installed?

Delete it entirely, not just deactivate it. Then rotate every wallet key the plugin stored, audit for overwritten payment configuration, check logs for unauthorized AJAX requests, and scan for web shells.

What’s wrong with just deactivating the plugin?

Deactivating doesn’t remove the plugin’s files from the server. The AJAX endpoint might stay accessible as long as the plugin directory is kept in place on the server.

Am I safe if no payments ever passed through my wallet through the plugin?

Maybe not. Since the vulnerability reveals stored credentials, there could be a chance that the wallet details were accessed despite there being no completed transactions.

Source: The Hacker News