CryptoPayment Gateway WordPress Plugin Has No Fix for Maximum Severity Flaw Exposing Wallet Credentials (CVE-2026-81648)

Scope: CryptoPayment Gateway WordPress plugin, versions 1.2.1 through 1.2.2 (no patched version exists)

Severity: Red

CVE-2026-81648 is a maximum severity, CVSS 10.0 flaw in CryptoPayment Gateway, a WooCommerce extension that lets WordPress-based stores accept Bitcoin, Bitcoin Cash, Litecoin, and Dogecoin payments. The plugin’s AJAX endpoint applies no authorisation check whatsoever, meaning a completely unauthenticated attacker, with no WordPress account and no user interaction required, can invoke administrative operations including deleting arbitrary files on the server, overwriting the payment gateway’s configuration, and recovering stored cryptocurrency wallet credentials in plain, unencrypted text. Defused Cyber’s deception network recorded the first confirmed in-the-wild exploitation attempts against this flaw, with no prior public report of real-world attacks before now. There is no fix available and none is coming: the plugin was already removed from the official WordPress Plugin Directory on August 28, 2026 over a separate, unrelated security issue, which means it is no longer maintained and will not receive a patch for this flaw either. Given that this plugin directly handles cryptocurrency wallet addresses for merchants, any site still running it is exposing not just the website but the store owner’s crypto funds to theft. Site owners must deactivate and completely remove the cryptopayment-gateway plugin today, and should treat any wallet address or credential that was ever configured in it as compromised, moving funds and generating new wallet credentials rather than reusing the exposed ones.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.