Defused Cyber Flags Exploit Attempts Against Critical WordPress Crypto Flaw

Defused Cyber has observed attempted attacks against CryptoPayment Gateway, a WordPress crypto-payment plugin, exploiting a critical flaw that can expose merchants’ wallet credentials and alter payment settings or delete server files. Tracked as CVE-2026-81648, the flaw affects versions 1.2.1 through 1.2.2 and carries a CVSS 3.1 score of 10.0, rated Critical. A missing authorization check on an AJAX endpoint allows users without accounts to retrieve wallet settings, change payment configuration or delete files on the server. Credential retrieval requires the plugin to have been activated at least once; the file-deletion action does not.

Source: TokenPost