Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials

Threat actors are actively exploiting CVE-2026-81648, a maximum-severity (CVSS 10.0) vulnerability affecting versions 1.2.1 through 1.2.2 of the CryptoPayment Gateway plugin for WordPress. The flaw stems from a missing authorization check on an AJAX endpoint, enabling unauthenticated remote attackers to execute administrative functions, delete arbitrary server files, and steal cleartext wallet credentials.

Source: The Hacker News

How Mangudai Discovers This Issue

Mangudai's port module scans exposed web services to discover active WordPress installations and plugin assets. By detecting vulnerable CryptoPayment Gateway plugin versions (1.2.1–1.2.2) via publicly accessible paths, it flags the unpatched CVE-2026-81648 vulnerability signature.

Continuous Autonomous AuditsMangudai scans target perimeters multiple times daily to catch configuration drift instantly.

Zero-Agent ArchitectureIdentifies exposure angles without requiring local installations or server access.

Check what your own domain exposes

A free scan lists the services, software versions, certificates and headers your domain shows to the internet, so you can see whether a flaw like this could apply to you. It reads what is visible from the outside; it does not confirm that a specific vulnerability can be exploited.

Launch Scan For My Domain