Unpatched CryptoPayment Gateway Vulnerability CVE-2026-81648 Exploited by Threat Actors

Threat actors are exploiting an unpatched critical vulnerability (CVE-2026-81648) in the CryptoPayment Gateway WordPress plugin, which allows unauthenticated file deletion and credential extraction. The flaw carries a CVSS score of 10.0, indicating severe risk to affected systems.

Threat actors are attempting to exploit an unpatched maximum-severity security vulnerability in the CryptoPayment Gateway WordPress plugin, according to findings from Defused Cyber.

The vulnerability in question is CVE-2026-81648, which carries a CVSS score of 10.0. Successful exploitation of the flaw could permit unauthenticated users to delete arbitrary files on the server and extract

Read original article