CVE-2026-81648
10.0CVSS base score · critical (NVD)
0.5%Chance of exploitation in the next 30 days (FIRST EPSS)
Not in KEVNo confirmed exploitation in CISA's catalog yet
What happened
Threat actors are actively exploiting CVE-2026-81648, a maximum-severity flaw in the CryptoPayment Gateway WordPress plugin with a CVSS score of 10.0. The vulnerability allows unauthenticated attackers to delete arbitrary files and extract wallet credentials. Organizations using this plugin should immediately apply available patches or disable the plugin until fixes are released.
From the Intel60 brief of Nov 3, 2026. AI-written summary: check the sources before acting.
Intel60 briefs
- CriticalCryptoPayment Gateway WordPress plugin CVSS 10.0 flaw exploitedNov 3, 2026