CryptoPayment Gateway: unpatched 10/10 flaw under attack
Crypto deposits on WordPress are exposed with no patch coming: file deletion, config rewrite, cleartext keys. Remove the plugin and rotate keys.
Who is affected
- WordPress plugin CryptoPayment Gateway versions 1.2.1 and 1.2.2, including deactivated installs
- Hotel microsites accepting cryptocurrency deposits through this plugin
- Roughly 1,845 installs still counted after the plugin was pulled from the official directory
How to fix
Remove the plugin from every site, even when deactivated: the file-deletion path stays reachable as long as the code is present. Delete residual files under wp-content/plugins. Rotate cryptocurrency wallet keys and any secret stored by the plugin without delay, and audit the payment-gateway configuration. Hunt web logs for requests to the plugin's AJAX endpoint. Until a fixed release exists, do not reinstall; block the path at the WAF.
What happened
The WordPress plugin CryptoPayment Gateway, versions 1.2.1 and 1.2.2, applies no authorization check on one of its AJAX endpoints. An unauthenticated attacker can delete arbitrary files on the server, rewrite the payment-gateway configuration, and recover the plugin's stored cryptocurrency wallet credentials in cleartext. CVE-2026-81648, scored 10.0 (CVSS 3.1) by NVD, was published on September 13; the plugin was closed in the official WordPress directory on August 28, but no fixed release exists to date and roughly 1,845 installs remain counted, with downloads still recorded. Since November 3, in-the-wild exploitation attempts have been observed, coming from infrastructure rented as "anonymous KYC-free VPS". That observation currently rests on a single source; the flaw itself is confirmed.
Why it matters for a hotel
A microsite taking crypto deposits through this plugin exposes three things at once: the property's wallet keys, the payment configuration that an attacker could silently redirect to another destination, and site file integrity, deletions being usable as a stepping stone. The counterintuitive part: the flaw stays reachable as long as the code sits on the server, deactivation included. For a property with no patch process, the right question is not "update" but "remove".
Who is affected
- Any WordPress site that ever installed CryptoPayment Gateway 1.2.1 or 1.2.2, active or not.
- Resorts, campgrounds and hotels publishing a crypto deposit option on a microsite or booking page.
- Shared hosting, where a neighbor property's uncleaned site stays reachable.
How to fix
- Remove the plugin from every site, even deactivated, then delete residual files under wp-content/plugins.
- Rotate cryptocurrency wallet keys and any secret the plugin stored without delay; treat any wallet whose key lived there as compromised.
- Audit the gateway configuration (destination addresses, thresholds, modes) for unauthorized changes.
- Hunt web logs for calls to the plugin's AJAX endpoint and for abnormal file deletions.
- Do not reinstall until a fixed release exists; if crypto deposits are essential, move them to a hosted service separated from the microsite.
Context
This case captures the microsite-specific risk: a lightly maintained plugin, removed from the directory yet never removed from servers, carrying a 10.0-rated flaw and a fix that is not coming. This week's WordPress wave (core update race, LiteSpeed Cache, Security For WooCommerce, WP Libre Form) confirms that plugin inventory, deactivated installs included, has become a hotel exploitation reflex on par with endpoint inventory.