Hackers Are Attacking a Crypto Payment Plugin for WordPress

A plugin that helps websites accept crypto has a serious security hole. Attackers are already trying to use it. Here is the story, plus the exact steps to protect your site

What happened?

Security researchers at a company called Defused Cyber noticed something worrying. Hackers are trying to break into websites that use a WordPress plugin named CryptoPayment Gateway. This plugin lets online shops accept payments in cryptocurrency.

The security hole is officially named CVE-2026-81648. A CVE is just a public ID number for a known security problem, so everyone can talk about the same bug.

What exactly is wrong with the plugin?

Think of a shop with a back office. Only the owner should be allowed in. In this plugin, one door to that back office has no lock and no guard. Anyone on the internet can walk in and press the owner’s buttons.

In technical terms, one of the plugin’s AJAX endpoints (a small background web address the plugin uses to do tasks) does not check whether the visitor is allowed to use it. This is called a missing authorization check. According to the public record on the US National Vulnerability Database, a stranger could use this to:

Which versions are affected, and is there a fix?

Versions 1.2.1 to 1.2.2 have the bug. Version 1.2.2 is the newest one, so you cannot simply “update to the latest version” to be safe. The vulnerability tracker WP Scan lists no known fix.

There is another warning sign. On August 28, 2026, the plugin was closed on the official WordPress Plugin Directory. It can no longer be downloaded there. The listed reason was only a general “security issue”.

How many websites could be affected?

Probably not many. The plugin has been downloaded 1,845 times in total, and about 20 times in the last seven days. Nobody knows how many of those copies are still running on live websites.

But do not relax just because the number is small. Shops that use crypto plugins often hold real money, and that makes them a good target. Defused Cyber also said the attacks came from servers sold as “anonymous” hosting with no identity checks, which suggests the attackers want to hide who they are.

What should you do right now?

Step 1: Check if you are using the plugin

If you can use the command line with WP-CLI (a free tool for managing WordPress), run:

wp plugin list | grep -i crypto

No command line? Open your WordPress dashboard and go to Plugins → Installed Plugins, then look for “CryptoPayment Gateway”.

Step 2: Remove it completely

Turning a plugin off is not enough. Delete it. Replace plugin-folder-name with the real folder name shown in the list above (check it first, since it may differ).

wp plugin deactivate plugin-folder-name
wp plugin delete plugin-folder-name

Step 3: Replace your wallet keys

Assume the keys the plugin saved are already stolen. Create a new wallet or new API keys with your wallet provider, move your funds to the safe place, and update your shop to use the new details. Do this on a clean device if you can.

Step 4: Look for signs of a break-in

See which files changed in the last 30 days:

find wp-content -type f -mtime -30 -ls

Check that no strange admin users were added:

wp user list –role=administrator

Compare WordPress core and your other plugins with the official originals. Any “FAILED” line means a file was changed:

wp core verify-checksums
wp plugin verify-checksums –all

Search your web server log for suspicious POST requests to the AJAX address (the log path is different on every host, so adjust it):

grep “admin-ajax.php” /var/log/nginx/access.log | grep POST | tail -n 100

Many requests from one unknown address, especially around the date the attacks started, deserve a closer look.

Step 5: Pick a safer replacement

Choose a payment plugin that is still updated, has many active installs, and is listed on the official WordPress directory. Better still, use a hosted payment service, so wallet secrets never sit on your own server.

Step 6: Add a few safety habits

These lines in wp-config.php stop people from editing plugin files inside the dashboard and turn on automatic security updates for WordPress core:

define( ‘DISALLOW_FILE_EDIT’, true );
define( ‘WP_AUTO_UPDATE_CORE’, true );

Also keep regular backups stored away from your server, so you can recover if files are deleted.

The lesson

Two simple habits would have reduced the risk here:

1. Watch your plugins. If a plugin suddenly disappears from the official directory, find out why. It is often a security warning.
2. Never keep secrets in plain text. If wallet keys are stored where a single missing check can expose them, one small mistake becomes a very big loss

CryptoPayment Gateway WordPress Vulnerability – FAQs