# Unpatched CryptoPayment WordPress Plugin Bug Lets Attackers Steal Wallet Credentials and Rewrite Settings

*Tuesday, November 3, 2026 at 6:18 AM UTC — Hamer Intelligence Services Desk*

**Published**: 2026-11-03T06:18:44.087Z (2h ago)
**Category**: cyber | **Region**: Global
**Importance**: 7/10
**Sources**: OSINT
**Permalink**: https://hamerintel.com/data/articles/22332.md
**Source**: https://hamerintel.com/summaries

---

**Deck**: Attackers are exploiting CVE-2026-81648, a CVSS 10.0 vulnerability in the CryptoPayment Gateway WordPress plugin, to extract wallet credentials, delete files and overwrite payment settings, with no fix yet available.

A severe security flaw in a WordPress plugin used for cryptocurrency payments is under active attack, putting sites that rely on it at risk of theft and quiet manipulation of their transactions.

Researchers have identified exploitation attempts against CVE-2026-81648, a vulnerability in the CryptoPayment Gateway plugin. The bug has been rated at the top of the CVSS scale, 10.0, because it lets unauthenticated attackers carry out powerful actions without needing valid login details.

According to public reporting, attackers can use the flaw to extract wallet credentials, delete files on the server and overwrite payment configuration settings. Monitoring shows that malicious actors are already scanning for and targeting WordPress sites that run vulnerable versions of the plugin. There is currently no known fix.

For merchants and service providers, the most direct risk is loss of funds. Access to wallet credentials can allow an attacker to move cryptocurrency out of associated wallets. The ability to rewrite payment settings means an intruder could redirect payments to their own addresses or alter how the plugin handles incoming transactions.

Customers may also be affected if compromised plugins are used to intercept transaction data or personal information entered during checkout. Because the vulnerability allows silent changes to how payments are processed, buyers might complete what appears to be a normal purchase while funds are being diverted.

The combination of unauthenticated access and broad capabilities makes CVE-2026-81648 especially dangerous on platforms where plugin updates and log reviews are not rigorously maintained. An attacker could potentially operate for some time without drawing attention.

This case illustrates the wider risk posed when critical financial functions are delegated to third-party extensions whose security posture may lag behind the core platform. A single design flaw in a widely used plugin can expose many independent sites at once.

Key questions now are how quickly the plugin developer can release a patch, whether hosting providers and security services move to detect or block exploit traffic, and how many confirmed theft or redirection incidents are ultimately linked to this vulnerability.