CVSS 10.0 WordPress CryptoPayment Gateway flaw sees exploit attempts

En bref

• CVE-2026-81648 has a CVSS score of 10.0, the highest possible.
• The issue affects the CryptoPayment Gateway plugin for WordPress.
• No account or login is needed to try exploiting the bug.
• Successful attacks could remove files and reveal wallet secrets.
• Defused Cyber is named in the disclosure; unpatched sites remain at risk.

A WordPress plugin used for crypto payments, CryptoPayment Gateway, contains a flaw tracked as CVE-2026-81648. Defused Cyber is named in connection with the disclosure. During November 2026, attempts to exploit the bug against installations that had not been fixed were recorded. The vulnerability is rated CVSS 10.0, the top of the scale, and attackers do not need to authenticate before trying to abuse it.

The impact is twofold. A successful attack could let someone remove files from the affected site without authorization, which may break pages, disrupt payment flows, or erase evidence. It could also expose wallet credentials, putting funds and related accounts at risk. For any site that handles payments, those outcomes raise both operational and financial concerns.

Any WordPress deployment with the vulnerable plugin should be treated as potentially exposed. In a K-12 setting, that includes district or school sites that use the plugin for activity fees, fundraisers, or other payment pages. Sites that do not have the plugin installed are not directly affected, but confirming that requires an accurate inventory rather than assumption.

The combination of public exploit attempts, no login requirement, and a maximum CVSS score makes this a high-priority issue. Even organizations that do not intentionally process crypto payments may find the plugin present through a theme bundle, a legacy install, or an inherited site. Unpatched software remains the main path to compromise.

Watch for a fixed release from the plugin maintainer and for updated guidance from Defused Cyber. Until a fix is applied, reducing exposure through removal or virtual patching is the safest course. Review web logs for probing tied to CVE-2026-81648, and treat wallet secrets as compromised if exploitation is suspected.

À faire maintenant

1. Inventory every WordPress site and record whether CryptoPayment Gateway is installed and which version is running.
2. If the plugin is not required, deactivate and delete it immediately.
3. If the plugin is required and a fixed release is available, update it now; if no fix exists, disable the plugin or take the payment page offline until mitigated.
4. Add WAF or virtual patching rules to block exploit probes for CVE-2026-81648, and review logs for attempted access.
5. Rotate wallet keys, seeds, and API tokens that may have been exposed, and review recent transactions for unauthorized activity.
6. Check file integrity and restore any deleted or altered files from a known-good backup.
7. Monitor Defused Cyber and plugin vendor advisories, then rescan all sites after patching.

Références CVE

• CVE-2026-81648

Source originale

The Hacker News