Hackers Hunt WordPress Shops Running a Dead Crypto Plugin

Key points

• CryptoPayment Gateway, a WordPress plugin for taking crypto payments, was pulled from the WordPress.org store for a security issue, with no fix released to the sites still running it.
• The flaw, CVE-2026-81648, scores the maximum 10 out of 10 and lets a complete stranger on the internet read a shop's stored crypto wallet credentials in plain text.
• The same bug lets attackers delete files on the server and rewrite the payment settings, so future customer payments can be routed to a wallet the criminals control.
• Versions 1.2.1 and 1.2.2 are affected, and because the plugin is abandoned there is no patched version to upgrade to.
• Attack attempts against live sites are already underway, first reported by The Hacker News citing honeypot data from Defused Cyber.

Small online shops that take Bitcoin or other cryptocurrencies through WordPress are the target this week. The people behind the plugin they rely on have already walked out of the building.

The plugin is called CryptoPayment Gateway. It let a WordPress site owner accept crypto payments without signing up to a big processor. The WordPress.org plugin directory closed the listing and marked the reason as a security issue. No replacement has appeared.

Not long after, the reason went public.

What does the flaw actually let attackers do?

It lets any visitor act as the shop's administrator for the parts of the plugin that matter. No password, no login, no trickery against staff.

The root cause is an AJAX endpoint, one of the behind-the-scenes URLs a WordPress site uses to handle live actions, that didn't check who was calling it. The National Vulnerability Database entry for CVE-2026-81648 spells out three things an unauthenticated caller can do: delete arbitrary files on the server, overwrite the payment gateway's configuration, and pull back the stored wallet credentials in cleartext.

That last one is the money shot. Cleartext means the private keys and API credentials for the shop's crypto wallet are readable, not scrambled. Whoever grabs them can empty the wallet.

The configuration rewrite matters almost as much. A criminal can quietly swap the receiving wallet address so tomorrow's customers pay the attacker instead of the shop, and nothing on the checkout page looks wrong.

Who is affected and what should they do?

Any WordPress site running CryptoPayment Gateway version 1.2.1 or 1.2.2 is exposed, and there's no patch coming.

The only safe move is to deactivate and delete the plugin now, then rotate the wallet credentials it was holding. Treat the stored keys as already stolen: on an internet-exposed site with a 10.0 bug and live exploitation, assuming otherwise is wishful.

Shop owners who took crypto payments through the plugin recently should check their wallet transaction history and their plugin settings for a receiving address they don't recognise.

Why this one is worse than the usual WordPress scare

Most WordPress plugin flaws end with a patched version and a nag to update. This one ends with a tombstone. We've covered the abandoned-plugin problem before, most recently in October, but a dead crypto payment plugin raises the stakes in a specific way: the loot is liquid and portable, and the vulnerable code indexes the credentials itself.

When a plugin is closed on WordPress.org for a security issue, existing installs keep running. They don't auto-remove and they won't receive a fix. The site owner has to notice, and most won't, because a plugin that still works doesn't shout for attention. That gap between "abandoned" and "removed from live sites" is where attackers live.

The honest read on the next few weeks: victim count will be small, but the per-victim loss won't be.