# Unpatched CryptoPayment Gateway plugin bug lets attackers steal WordPress wallet credentials

*Tuesday, November 3, 2026 at 6:14 AM UTC — Hamer Intelligence Services Desk*

**Published**: 2026-11-03T06:14:18.679Z (2h ago)
**Category**: cyber | **Region**: Global
**Importance**: 7/10
**Sources**: OSINT
**Permalink**: https://hamerintel.com/data/articles/22322.md
**Source**: https://hamerintel.com/summaries

---

**Deck**: Attackers are exploiting CVE‑2026‑81648, a CVSS 10.0 flaw in the CryptoPayment Gateway WordPress plugin, to grab wallet credentials, delete server files and rewrite payment settings. With no fix available, sites using the plugin face a direct threat to cryptocurrency funds and transaction records.

A severe security flaw in the CryptoPayment Gateway WordPress plugin is under active exploitation, putting cryptocurrency payments handled through vulnerable sites at immediate risk.

The bug, tracked as CVE‑2026‑81648 and scored 10.0 on the CVSS scale, allows unauthenticated attackers to target sites that have the plugin installed. Security researchers say exploitation attempts have already been observed in the wild.

The vulnerability lets remote attackers extract wallet credentials, delete files from the server and overwrite the plugin’s payment settings. In practice, that combination can expose keys or access data used to move funds, change where payments are sent and remove evidence by tampering with files.

According to current reporting, there is no known fix or patch for CryptoPayment Gateway. Administrators are left with mitigations such as disabling or removing the plugin, adding firewall rules or isolating affected instances while they look for alternatives.

For merchants and other operators who rely on WordPress sites to process cryptocurrency transactions, the stakes are high. Successful exploitation can mean stolen funds and corrupted transaction records, along with reputational damage once customers realise payments have been diverted.

The flaw also underlines how much of the cryptocurrency ecosystem depends on third‑party web components that may not receive the same security attention as larger exchanges or wallet providers. A single vulnerable plugin can give attackers a shortcut around more heavily defended infrastructure.

Signals to watch now include any emergency advisory or update from the plugin’s developer, signs of broad scanning for vulnerable sites, and reports from compromised merchants. Hosting providers or managed WordPress platforms may also intervene by blocking or removing the plugin if they assess the risk as systemic.