Critical Remote File Deletion & Credential Exposure in CryptoPayment Gateway WordPress Plugin (CVE‑2026‑81648)
What It Is — Defused Cyber disclosed that the CryptoPayment Gateway WordPress plugin contains a maximum‑severity vulnerability (CVE‑2026‑81648) with a CVSS 10.0 score. The flaw allows an unauthenticated attacker to delete arbitrary files on the hosting server and to read files that contain cryptocurrency wallet credentials. Exploitation requires only a crafted HTTP request; no valid login is needed. The vulnerability is currently unpatched in released versions of the plugin, and proof‑of‑concept code has been published publicly.
Affected Products — CryptoPayment Gateway WordPress plugin (all released versions prior to an official fix).
Why It Matters for Trust & Control Assurance — The issue underscores the importance of continuous third‑party component monitoring and rapid patching to satisfy a core vulnerability‑management control objective. Capability focus: Vendor Risk Management.
Recommended Actions
- Inventory every web site that runs the CryptoPayment Gateway plugin.
- Verify the installed version and apply the vendor’s patch (or temporarily disable the plugin) immediately.
- Integrate the plugin into your vulnerability‑scanning pipeline and set a remediation SLA for critical third‑party flaws.
- Enable file‑integrity monitoring and alert on unexpected deletions or reads of credential files.
- Document the remediation steps as audit evidence for your control‑assurance program.
Source: The Hacker News – Attackers Target Unpatched CryptoPayment Gateway Flaw