CryptoPayment Gateway WordPress plugin CVSS 10.0 flaw exploited

Threat actors are actively exploiting CVE-2026-81648, a maximum-severity flaw in the CryptoPayment Gateway WordPress plugin with a CVSS score of 10.0. The vulnerability allows unauthenticated attackers to delete arbitrary files and extract wallet credentials. Organizations using this plugin should immediately apply available patches or disable the plugin until fixes are released.