Attackers are actively trying to exploit an unpatched flaw in the CryptoPayment Gateway plugin for WordPress that carries the maximum possible severity score, according to The Hacker News, which reported the findings of security firm Defused Cyber.

The flaw, tracked as CVE-2026-81648, is rated 10.0 out of 10. It affects versions 1.2.1 and 1.2.2 of the plugin, which lets WooCommerce shops accept cryptocurrency payments such as Bitcoin, Bitcoin Cash, Litecoin and Dogecoin. Because version 1.2.2 is the latest release, there is no patched version to update to.

The problem is a missing authorisation check on one of the plugin's AJAX endpoints. An unauthenticated visitor can call administrative actions through WordPress's standard AJAX handler, including get-settings, save-settings and delete-file. That means an attacker can delete arbitrary files on the server, rewrite the shop's payment settings, and read stored wallet credentials in clear text.

Changing the payment settings is the most dangerous outcome: an attacker could swap the merchant's wallet address for their own, so future customer payments would go to the attacker instead of the shop. Defused Cyber said the exploitation attempts it observed came from infrastructure sold as anonymous, identity-check-free VPS hosting.

The flaw was disclosed in September 2026 and credited to researcher Pedro Pinho, with WPScan coordinating disclosure. The plugin was already closed on the official WordPress Plugin Directory on 28 August 2026 over a security issue, yet about 1,845 installs were still counted, with downloads still being recorded.

With no fix available, the only safe course is to remove the plugin completely, including from sites where it is deactivated, delete leftover files, rotate all wallet keys and credentials stored by the plugin, and check payment settings and server logs for unauthorised changes.