Security notice

WordPress site using CryptoPayment Gateway? A flaw rated 10 has no fix, and attack attempts are reported. Remove it.

Last updated: Tuesday, November 3, 2026, 8:25 AM ETStatus: No fix. Attack attempts reported. Remove the plugin now.

CryptoPayment Gateway is a WordPress plugin for taking cryptocurrency payments. It is small: The Hacker News reports 1,845 downloads in total. WordPress.org closed it on August 28, 2026 for a "Security Issue," and it has no fix. CVE-2026-81648, published September 13, rates 10 out of 10. In versions 1.2.1 and 1.2.2, the latest, anyone with no login can delete files on your server, overwrite the plugin's payment settings and read the stored wallet keys in plain text. On November 2, 2026, the security firm Defused Cyber said it saw attack attempts in the wild, and The Hacker News reported it on November 3. We found no report that any attempt succeeded, and CISA does not list it as exploited. If your site has this plugin, remove it completely today. Deactivating it is not enough. Then replace your wallet keys, check that your payment address is still yours, and check the site for changes.

What happened

The flaw. The CVE record says the plugin "does not apply an authorization check on one of its AJAX endpoints," which lets "unauthenticated users" do administrator tasks: "deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext." In plain words, a stranger with no account can wipe files from your server, change where your payments go and read your stored wallet keys. We are leaving out the technical details. (CVE record, WPScan)
How serious. The CVE record, assigned by WPScan, rates it CVSS 10.0, which is 10 out of 10, the highest score. NVD marks it "Deferred" and shows no score of its own. (CVE record, NVD)
Affected versions, and no fix. Versions 1.2.1 through 1.2.2. WordPress.org shows 1.2.2 as the latest version, last updated about a year ago. WPScan lists "No known fix," and we found no statement from the plugin's author. (CVE record, WordPress.org, WPScan)
The plugin is closed. WordPress.org says the plugin "has been closed as of August 28, 2026 and is not available for download. Reason: Security Issue." That was about two weeks before WPScan published its entry on September 10. The page gives no further reason. A closed plugin stays on any site that already installed it, and it does not update or remove itself. (WordPress.org, WPScan)
Inactive does not mean safe. WPScan says the file deletion needs only that the plugin's files are on the server, and that reading and changing the settings needs the plugin to have been activated at least once. So a plugin you deactivated, or never switched on, can still be abused if its files are still there. (WPScan)
Attack attempts reported. On November 2, 2026, Defused Cyber said on X: "We are observing in-the-wild exploitation attempts against CVE-2026-81648," and that there had been no earlier public report of it being exploited. The Hacker News reported it on November 3 and says the attacks it recorded came from infrastructure that markets itself as "Anonymous KYC-Free VPS Hosting." Neither says any site was taken over or any wallet emptied, and we found no such report. (Defused Cyber, The Hacker News)
Not on CISA's list. CISA KEV does not list the flaw in its version dated October 30, 2026, which we checked directly on November 3. CISA's assessment on the CVE record, dated September 14, said exploitation was "none," which was before these attempts were reported. (CISA KEV, CVE record)
How many sites. The Hacker News says the plugin was downloaded 1,845 times in total, 20 of them in the last seven days, and that it is unclear whether it is installed on any sites. WordPress.org shows no installation count. We could not confirm the total. Most WordPress sites do not have this plugin. (The Hacker News, WordPress.org)

Who should worry

This is about WordPress websites that took cryptocurrency payments with the CryptoPayment Gateway plugin. If you are not sure whether your site uses it, ask your web developer or agency. Ask about this if any of these are true:

Your WordPress site has CryptoPayment Gateway installed, active or not, on version 1.2.1 or 1.2.2.
Your site has accepted cryptocurrency through a plugin and you do not know which one.
An agency or developer set up your payments and you do not know which plugin runs them.
You run a web agency or host and look after WordPress sites for clients.

If your site does not have this plugin, this notice does not apply to you.

What to do now

Do these today. No fixed version exists, so removing the plugin is the only fix.

Check if you have it. In your WordPress dashboard, open Plugins, then Installed Plugins, and look for "CryptoPayment Gateway." If you cannot sign in, ask your developer or host to look in the site's wp-content/plugins folder for a folder named cryptopayment-gateway, whether or not it is active.
Remove it completely. Deactivate it, then delete it, so that its files are gone from the server. Deactivating alone is not enough, because the file deletion works while the plugin's files are present. You will lose cryptocurrency checkout until you replace it with something else. (WPScan, The Hacker News)
Replace your wallet keys. The CVE record says stored wallet credentials can be read in plain text, so treat the keys the plugin held as exposed. The Hacker News advises rotating wallet keys. As our own general advice, ask your wallet provider or developer how to create a new wallet and keys and move funds to them, and do not reuse the old keys. (CVE record, The Hacker News)
Check your payment address. The CVE record says the plugin's payment settings can be overwritten. As a general check, not from the sources, compare the wallet address in the plugin's settings, or in a backup taken before November 2, with your own, and look at recent payments to see that they reached you.
Audit the site. The Hacker News advises auditing for suspicious changes. As a general check, ask your developer or host to look for files that have gone missing, PHP files you did not add, administrator accounts you do not recognize, and unusual requests to the plugin's folder in your server logs. If you find anything, treat the site as compromised: restore from a known-good backup, then change the WordPress admin and database passwords and the WordPress salts. (The Hacker News)
Check your site afterwards. Make a test purchase with your replacement payment method and confirm it works and pays you.

What to send your developer, agency or host

The CryptoPayment Gateway WordPress plugin (cryptopayment-gateway) 1.2.1 and 1.2.2 has a maximum severity flaw, CVE-2026-81648 (CVSS 10.0, assigned by WPScan, published September 13, 2026). Anyone with no login can delete files, overwrite the payment settings and read stored wallet keys in plain text. There is no fix, WordPress.org closed the plugin on August 28, 2026, and Defused Cyber reported attack attempts on November 2. Please tell us whether our site has this plugin, installed or active. If it does, please remove it completely today, not just deactivate it, replace any wallet keys it held, check that the payment address in the settings or in a backup is ours, check for missing files, unknown PHP files and unfamiliar administrators, and tell us what you find. If anything looks wrong, please treat the site as compromised, restore a known-good backup and change the admin and database passwords and the WordPress salts. Sources: The Hacker News, WPScan, the CVE record, WordPress.org.

Common questions

Has my site been hacked?

This notice does not mean your site has been hacked. It means a maximum severity flaw with no fix has been published and attack attempts have been reported. We found no report that any attempt worked.

Can EverThread tell me if I am affected?

No. EverThread does not test for this. We check your home page from the outside, the way a browser sees it. We cannot see which plugins your site runs or which versions they are on, so if our scan does not warn you about this plugin, that does not mean you are safe. Our free scan does look at your home page for other common problems, such as an expired padlock certificate, missing browser safety settings and files that should not be public.

Is there an update?

No. WPScan lists no known fix, 1.2.2 is the latest version, and WordPress.org has closed the plugin. Removing it is the only fix. (WPScan, WordPress.org)

I deactivated it. Am I safe?

Not if its files are still on your server. WPScan says the file deletion needs only that the plugin's files are present. Delete the plugin. (WPScan)

Is it being exploited?

Defused Cyber reported in-the-wild attack attempts on November 2. We found no report that an attempt succeeded, and CISA does not list it as exploited. (Defused Cyber, The Hacker News, CISA KEV)

Where can I follow official updates?

The WPScan entry and the WordPress.org page. All current notices are on our notices page.

Security alerts by email

Hear about the next one first.

When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.

Sources

The Hacker News: Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials, Ravie Lakshmanan, November 3, 2026, checked November 3, 2026
Defused Cyber: post on in-the-wild attempts against CVE-2026-81648, November 2, 2026, checked November 3, 2026
WPScan: CryptoPayment Gateway 1.2.1 to 1.2.2: Unauthenticated Arbitrary File Deletion and Settings Update via Unguarded AJAX Router, published September 10, 2026, checked November 3, 2026
CVE Program: CVE-2026-81648, published September 13, 2026 by WPScan, checked November 3, 2026
NVD: CVE-2026-81648, status Deferred, checked November 3, 2026
WordPress.org: CryptoPayment Gateway plugin page, closed August 28, 2026, checked November 3, 2026
CISA: Known Exploited Vulnerabilities Catalog, catalog version dated October 30, 2026, checked November 3, 2026