# Unpatched CryptoPayment Gateway Plugin Flaw Lets Hackers Steal Wallet Keys and Wipe WordPress Files

*Tuesday, November 3, 2026 at 6:20 AM UTC — Hamer Intelligence Services Desk*

**Published**: 2026-11-03T06:20:39.848Z (2h ago)
**Category**: cyber | **Region**: Global
**Importance**: 7/10
**Sources**: OSINT
**Permalink**: https://hamerintel.com/data/articles/22338.md
**Source**: https://hamerintel.com/summaries

---

**Deck**: Attackers are exploiting CVE-2026-81648, a CVSS 10.0 vulnerability in the CryptoPayment Gateway WordPress plugin, to extract wallet credentials, delete server files, and overwrite payment settings, with no fix currently available.

A critical vulnerability in the CryptoPayment Gateway WordPress plugin is under active attack, opening the door to wallet theft, checkout hijacking, and data loss on sites that use it to process cryptocurrency payments.

The bug, tracked as CVE-2026-81648, carries the maximum CVSS score of 10.0. Security researchers have already observed exploitation attempts in the wild, indicating that attackers are scanning for and targeting vulnerable installations.

Technical analyses say unauthenticated attackers can leverage the flaw to extract stored wallet credentials, delete files on the server, and overwrite key payment settings. In practical terms, that means an intruder can redirect funds to their own wallets, corrupt the site, or both.

There is currently no known fix for the vulnerability. That leaves site operators with few straightforward options beyond disabling or removing the plugin, adding strict web application firewall rules, or isolating affected sites from handling live crypto transactions until an update is available.

Signs to monitor now include any emergency advisory or update from the plugin developer, moves by hosting and managed WordPress providers to block or remove the plugin, and reports of fraud or site compromises linked to CVE-2026-81648.