WordPress Crypto Plugin Flaw Exposes Wallet Credentials

A critical, unpatched flaw in a WordPress crypto payment plugin is being actively exploited, allowing attackers to delete files and steal credentials.

A critical, unpatched vulnerability in the CryptoPayment Gateway WordPress plugin is being actively exploited by attackers, creating a severe risk for any website using it. According to a report from security firm Defused Cyber, the flaw, tracked as CVE-2026-81648, has been assigned a CVSS score of 10.0, the highest possible rating, indicating its extreme severity. The vulnerability allows an unauthenticated attacker—meaning anyone on the internet—to delete arbitrary files on the server where the WordPress site is hosted. This can lead to a complete site takeover, data loss, and the potential exposure of sensitive credentials, including those for cryptocurrency wallets.

Technically, the vulnerability stems from the plugin's failure to properly secure a function that handles file operations. An attacker can send a specially crafted request to the website that targets this weakness, instructing the server to delete a specific file without needing to log in or have any special permissions. The consequences of this arbitrary file deletion are catastrophic. For example, an attacker could delete the `wp-config.php` file, which contains the database connection credentials and security keys. Deleting this file would trigger the WordPress re-installation process, allowing the attacker to configure the site from scratch and grant themselves administrator access. Alternatively, they could delete security plugins or the `.htaccess` file to disable protective measures, leaving the site wide open for further attacks and making it easier to extract sensitive information.

The WordPress ecosystem, with its tens of thousands of third-party plugins, remains a prime target for cybercriminals. While the core WordPress software is generally secure, plugins are often the weakest link. Many are developed by small teams or individuals who may not have the resources for comprehensive security audits, leading to vulnerabilities that can put millions of websites at risk. This incident is a classic example of a supply chain risk, where the security of a website is compromised not through its own code, but through a third-party component it relies on. The fact that the vulnerability is both unpatched and actively exploited creates a dangerous race against time for site administrators, who must act before attackers discover their vulnerable installations. Payment gateway plugins are particularly high-value targets because they process financial transactions and handle sensitive customer data.

Given the lack of a security patch, the only viable course of action for administrators is to immediately disable and uninstall the CryptoPayment Gateway plugin. Simply deactivating it may not be enough, as leftover files could still potentially be exploited. Any organization that was using this plugin should operate under the assumption that their site has been compromised. A thorough security audit is necessary to check for backdoors, unauthorized administrator accounts, and any modified or suspicious files. Looking forward, this event serves as a stark reminder of the importance of plugin security hygiene. Teams should rigorously vet any plugin before installation, regularly remove unused plugins, and implement a Web Application Firewall (WAF) that can provide a layer of protection against zero-day exploits like this one. Until a patched and verified version of the plugin is released, it should be considered unsafe to use.

This CVSS 10.0 vulnerability allows unauthenticated, remote attackers to perform arbitrary file deletion. For developers and security teams, this represents a worst-case scenario: a simple exploit can lead to complete server compromise, data loss, and credential theft without needing any user credentials.

For businesses using this plugin, the financial and reputational risks are immense. Active exploitation means customer payment data and wallet credentials could be stolen, leading to direct financial loss, regulatory fines, and a severe breach of customer trust that could cripple operations.