Defused Cyber ma'lumotlariga ko'ra, tahdid aktorlari CryptoPayment Gateway WordPress plaginidagi tuzatilmagan maksimal darajadagi xavfsizlik zaifligini ekspluatatsiya qilishga urinmoqda.
Gap CVE-2026-81648 bo'lib, uning CVSS balli 10.0. Zaiflikdan muvaffaqiyatli foydalanish autentifikatsiyadan o'tmagan foydalanuvchilarga serverdagi ixtiyoriy fayllarni o'chirish va maxfiy ma'lumotlarni, jumladan saqlangan wallet ma'lumotlarini olish imkonini berishi mumkin.
"CryptoPayment Gateway WordPress plagini 1.2.1 dan 1.2.2 gacha versiyalarida AJAX endpointlaridan birida avtorizatsiya tekshiruvini qo'llamaydi, bu esa autentifikatsiyadan o'tmagan foydalanuvchilarga ma'muriy operatsiyalarni, jumladan serverdagi ixtiyoriy fayllarni o'chirish, to'lov shlyuzi konfiguratsiyasini qayta yozish va saqlangan wallet ma'lumotlarini ochiq matnda tiklashni chaqirishga imkon beradi", — deb ta'riflanadi NIST Milliy Zaifliklar Bazasi (NVD) da.
Zaiflik 1.2.1 dan 1.2.2 gacha versiyalarni ta'sir qiladi, bu esa eng so'nggi versiya hisoblanadi. WP Scan ma'lumotlariga ko'ra, zaiflik uchun ma'lum tuzatishlar yo'q. 2026-yil 28-avgust holatiga ko'ra, plagin WordPress Plaginlar Katalogidan yopilgan va aniqlanmagan "xavfsizlik muammosi" tufayli endi yuklab olish mumkin emas.
Statistikaga ko'ra, plagin jami 1 845 marta yuklab olingan, jumladan so'nggi yetti kun ichida 20 marta. Uning hozirda biror WordPress saytida faol o'rnatilgani noma'lum.
"Biz CVE-2026-81648, WordPress uchun CryptoPayment Gateway'dagi kritik (CVSS 10.0) zaiflikka nisbatan real dunyoda ekspluatatsiya urinishlarini kuzatmoqdamiz", — deb yozdi Defused Cyber X postida. "Biz qayd etgan hujumlar o'zini 'Anonymous KYC-Free VPS Hosting' deb marketing qiladigan infratuzilmadan keldi."
Tuzatish yo'qligida, sayt egalari plaginni o'chirish, wallet kalitlarini almashtirish va shubhali o'zgarishlarni tekshirish tavsiya etiladi.
Threat actors are attempting to exploit an unpatched maximum-severity security vulnerability in the CryptoPayment Gateway WordPress plugin, according to findings from Defused Cyber.
The vulnerability in question is CVE-2026-81648, which carries a CVSS score of 10.0. Successful exploitation of the flaw could permit unauthenticated users to delete arbitrary files on the server and extract sensitive data, including stored wallet credentials.
"The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext," according to a description of the flaw on the NIST National Vulnerability Database (NVD).
The vulnerability affects versions 1.2.1 through 1.2.2, which is the latest version. There are no known fixes for the flaw, according to WP Scan. As of August 28, 2026, the plugin has been closed on the WordPress Plugin Directory and is no longer available for download due to an unspecified "security issue."
Statistics show that the plugin has been collectively downloaded 1,845 times, including 20 downloads over the last seven days. It's unclear if it's actively installed on any WordPress sites.
"We are observing in-the-wild exploitation attempts against CVE-2026-81648, a critical (CVSS 10.0) flaw in the CryptoPayment Gateway for WordPress," Defused Cyber said in an X post. "The attacks we recorded came from infrastructure that markets themselves as 'Anonymous KYC-Free VPS Hosting.'"
In the absence of a fix, site owners are advised to remove the plugin, rotate wallet keys, and audit for any suspicious changes.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.