Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials

Threat actors are attempting to exploit an unpatched maximum-severity vulnerability in the CryptoPayment Gateway WordPress plugin, tracked as CVE-2026-81648 with a CVSS score of 10.0, according to Defused Cyber. Successful exploitation could let unauthenticated users delete arbitrary files on the server and extract wallet credentials.