# Defused Cyber Flags Exploit Attempts Against Critical WordPress Crypto Flaw

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/47700
Published: 2026-11-03T13:21:50.000Z
Updated: 2026-11-03T13:21:50.000Z
Section: Technology

> The vulnerability affects versions 1.2.1 through 1.2.2 and carries a CVSS 3.1 score of 10.0, rated Critical.

Defused Cyber has observed attempted attacks against CryptoPayment Gateway, a WordPress crypto-payment plugin, exploiting a critical flaw that can expose merchants’ wallet credentials and alter payment settings or delete server files.

Tracked as CVE-2026-81648, the flaw affects versions 1.2.1 through 1.2.2 and carries a CVSS 3.1 score of 10.0, rated Critical. A missing authorization check on an AJAX endpoint allows users without accounts to retrieve wallet settings, change payment configuration or delete files on the server.

Credential retrieval requires the plugin to have been activated at least once; the file-deletion action does not. The plugin’s latest listed release is version 1.2.2, and no patched release is listed. WordPress.org closed the plugin’s directory listing Aug. 28, 2026, for a security issue.

Defused Cyber linked its observed attempts to hosting infrastructure marketed as “Anonymous KYC-Free VPS Hosting,” but did not identify a threat actor. Its public post describes attempted exploitation and identifies no compromised merchant or stolen funds.