What happened
On September 10, 2026, the WPScan vulnerability database published a critical flaw in CryptoPayment Gateway, a WordPress plugin for accepting cryptocurrency payments. It is tracked as CVE-2026-81648 and as EUVD-2026-77085 in ENISA’s European database. It was found by researcher Pedro Pinho and added to the US National Vulnerability Database (NVD) on September 13, 2026.
The problem itself is simple. One of the plugin’s background functions (a so-called AJAX endpoint) never checks who is calling it. That means anyone on the internet can trigger operations meant only for administrators: deleting files on the server, overwriting the payment gateway settings and retrieving stored wallet credentials in plain text.
There is no patched version. WPScan lists no known fix, and according to The Hacker News the plugin was closed in the official WordPress Plugin Directory on August 28, 2026, over an unspecified security issue. It has not been available for download since.
On November 3, 2026, The Hacker News reported that the security firm Defused Cyber has observed exploitation attempts against this flaw in the wild. The attacks came from infrastructure that markets itself as “Anonymous KYC-Free VPS Hosting.” The US agency CISA has not added the flaw to its catalog of confirmed exploited vulnerabilities, and ENISA has not recorded confirmed exploitation either.
Why it is dangerous
This is a missing authorization check (CWE-862), which WPScan classifies as a broken access control flaw. Picture an office where the director’s door says “management only,” but it is unlocked and nobody checks who walks in. Anyone off the street can sit at the director’s desk and do as they please.
The attacker does not need to log in, does not need an account and does not need to trick anyone into clicking anything. All it takes is a site with the plugin that is reachable from the internet. What they can get:
- Deletion of arbitrary files on the server. This can take the site offline or damage important WordPress files.
- Overwriting the payment gateway settings. In practice, this could mean customer payments end up somewhere other than where they should.
- Retrieval of stored wallet credentials in plain text, which can lead to loss of funds.
Neither WPScan nor The Hacker News mentions running arbitrary code on the server or spreading further into the company network. For a shop that accepts cryptocurrency, it is still serious, because it directly involves money and customer trust.
The CVSS score rates a flaw’s severity on a scale from 0 to 10. This one scores 10.0, the maximum, as assigned by WPScan under CVSS 3.1. The rating reflects a network attack, low complexity, no login required and an impact that reaches beyond the plugin itself.
EPSS estimates the probability that a flaw will be exploited in the next 30 days. As of November 3, 2026, it stands at about 0.5%, higher than roughly 43% of other known vulnerabilities. The CISA KEV catalog lists flaws whose exploitation CISA has confirmed, and this one is not on it yet. Low numbers do not mean safety, since Defused Cyber is already seeing attack attempts.
Who is affected
It affects WordPress sites with the CryptoPayment Gateway plugin installed in version 1.2.1 or 1.2.2. Version 1.2.2 is the latest release, so there is no newer safe version. These are typically online shops and sites that accept cryptocurrency payments, whether they run on shared web hosting, a VPS or the company’s own server.
According to The Hacker News, the plugin has been downloaded 1,845 times in total, including 20 times over the last seven days. How many sites actually run it is unknown.
Sites that do not have this plugin are not affected. This is not a flaw in WordPress itself or in other payment plugins. Neither WPScan nor NVD says whether versions older than 1.2.1 are also vulnerable. Since the plugin is no longer available or maintained, we recommend removing it whatever version you have.
How to check if you are affected
The quickest way is the WordPress admin. Under Plugins, look for CryptoPayment Gateway and its version number. Check inactive plugins too, as their files stay on the server.
If you have SSH access and WP-CLI, run these commands in the site directory. They only read data and change nothing:
wp plugin list
wp plugin get cryptopayment-gateway --field=versionWithout WP-CLI, check whether the plugin folder exists on the server (usually cryptopayment-gateway) and read the version from its file headers:
ls -la wp-content/plugins/ | grep -i crypto
grep -i "Version:" wp-content/plugins/cryptopayment-gateway/*.phpIf you manage several sites or use managed hosting, ask your provider to check all installations.
How to fix it
There is no patched version, and WPScan lists no known fix. The plugin has also been closed in the WordPress directory, so no update is coming. The Hacker News advises removing the plugin, rotating wallet keys and auditing for suspicious changes. Work in this order:
- Back up the site and database. The backup serves as evidence if you later need to find out whether an attack happened.
- Deactivate and delete the plugin, either under Plugins in the admin or with WP-CLI.
- Rotate all wallet credentials and keys that were stored in the plugin. If they gave access to funds, move the funds to a new wallet.
- Check which wallet addresses payments went to, and confirm no files are missing from the site.
- Change WordPress administrator passwords and hosting access credentials.
- Switch to a different, actively maintained solution for accepting crypto payments.
wp db export backup-before-removal.sql
wp plugin deactivate cryptopayment-gateway
wp plugin delete cryptopayment-gatewayIf you cannot delete the plugin right away, for example because your shop depends on it, at least deactivate it immediately and temporarily turn off cryptocurrency payments. Neither WPScan nor The Hacker News mentions any other workaround. Do not wait for an update, as none has been announced.
What if you may already be compromised
Since Defused Cyber is seeing attack attempts, it is worth checking whether someone has already tried your site. No specific IP addresses or other technical indicators have been published. The only known detail is that the attacks came from infrastructure marketing itself as “Anonymous KYC-Free VPS Hosting.” What to look at:
- Web server logs: POST requests to
admin-ajax.phpfrom unknown IP addresses. WordPress and other plugins use this file too, so look for unusual volume or unfamiliar senders. - Payment gateway settings: changed wallet addresses or values you did not enter.
- Wallets and orders: transactions you did not approve, or payments sent to an address that is not yours.
- Missing or damaged files and broken parts of the site.
zgrep -hE '"POST [^ ]*admin-ajax\.php' /var/log/apache2/access.log* | less
zgrep -hE '"POST [^ ]*admin-ajax\.php' /var/log/nginx/access.log* | less
wp core verify-checksumsThe first command is for Apache, the second for Nginx, and both also search older compressed logs. Log paths vary by server, and on shared hosting you will find logs in the control panel or can request them from support. wp core verify-checksums compares WordPress files with the official ones and reports missing or modified files. If you find changed settings, unknown wallet activity or missing files, preserve the evidence and bring in a security professional.