Security researchers at Defused Cyber say threat actors are attempting to exploit an unpatched vulnerability in the CryptoPayment Gateway WordPress plugin. The reported flaw, tracked as CVE-2026-81648, has been assigned a CVSS score of 10.0, indicating maximum severity. According to the report, successful exploitation could allow unauthenticated attackers to delete arbitrary files on the server and extract wallet credentials.

What happened

The issue affects the CryptoPayment Gateway plugin for WordPress, a component used to support cryptocurrency-related payment workflows on websites. Based on the source report, attackers are already attempting to exploit the vulnerability before a patch is available.

The reported risk is particularly serious because the attack is described as unauthenticated. In practice, that means an attacker may not need a valid user account to try to abuse the flaw. If confirmed on an affected installation, that lowers the barrier to exploitation and can increase the likelihood of automated internet-wide attacks.

The source states that exploitation could let attackers delete arbitrary files from the server and obtain wallet credentials. Those two outcomes create both immediate operational risk for the website and potential financial risk where cryptocurrency transactions or wallets are involved.

Why it matters for European businesses

For European businesses, this is relevant beyond the cryptocurrency sector itself. Many SMEs and e-commerce operators rely on WordPress and third-party plugins to add payment, checkout and automation features quickly. That convenience also creates a supply-chain style security dependency: a serious flaw in a plugin can expose the wider website, payment operations and connected infrastructure.

If wallet credentials are exposed, affected businesses could face direct financial losses, service disruption and incident response costs. If arbitrary file deletion is possible, websites may also suffer outages, broken checkout flows or further compromise if attackers remove protective files or interfere with site operations.

There may also be data protection and compliance implications depending on how the compromised website is configured and what other systems it connects to. While the source specifically mentions wallet credentials and file deletion, businesses should treat any actively exploited website vulnerability as a broader security incident risk until they confirm scope and impact.

Who may be affected

• WordPress site owners using the CryptoPayment Gateway plugin
• E-commerce businesses accepting or testing cryptocurrency payments through WordPress
• Digital agencies and IT teams managing WordPress sites for clients
• SMEs relying on plugins for payment functionality without dedicated security monitoring
• Businesses with shared hosting or loosely segmented web environments, where a plugin compromise could affect broader site operations

What companies should consider

• Identify exposure immediately. Check whether any company or client WordPress sites use the CryptoPayment Gateway plugin, including staging environments and legacy installations.
• Monitor for official remediation. Because the flaw is described as unpatched, businesses should watch for updates from the plugin maintainer, WordPress plugin listings and trusted security advisories before applying a fix.
• Consider temporary mitigation. If the plugin is not business-critical, disabling it until a verified patch is available may reduce risk. Any operational decision should be assessed against payment continuity requirements.
• Rotate potentially exposed secrets. If there is any sign of compromise, review and rotate wallet credentials and any related secrets stored on the server.
• Review logs and file integrity. Check web server logs, WordPress activity, unexpected file deletions and indicators of unusual access attempts. File integrity monitoring can help detect tampering.
• Strengthen WordPress hardening. Restrict unnecessary plugin use, limit administrative access, maintain backups and ensure web application firewalls and endpoint monitoring are in place where possible.
• Prepare incident response steps. Businesses handling payments should be ready to isolate the affected site, restore from clean backups and notify relevant internal or external stakeholders if compromise is confirmed.

At this stage, the key facts are that researchers report active exploitation attempts against an unpatched, maximum-severity WordPress plugin flaw and warn that wallet credentials may be exposed. For businesses using this plugin, the priority is to verify exposure quickly and reduce risk while awaiting confirmed remediation guidance.