Threat actors are actively exploiting an unpatched maximum-severity vulnerability in the CryptoPayment Gateway WordPress plugin, tracked as CVE-2026-81648. The CVSS 10.0 flaw allows unauthenticated attackers to delete arbitrary files and extract sensitive wallet credentials from the server. Administrators should immediately remove the vulnerable plugin until a patch is released.
READ THE ORIGINAL ARTICLE AT THEHACKERNEWS.COM →