A Flaw With a Perfect 10 Score Is Putting Crypto Wallets at Risk

Robert Moore · 2026-11-03

There's a vulnerability out there with a severity score of 10.0 out of 10. That's the highest number you can get. And right now, attackers are actively trying to break through it. The flaw lives inside the CryptoPayment Gateway, a WordPress plugin that plenty of crypto-friendly sites rely on to handle payments. According to research from Defused Cyber, it's tracked as CVE-2026-81648. The scariest part? It's still unpatched. ### What Makes This One So Dangerous A CVSS score of 10.0 means the worst-case scenario is basically on the table. In this case, an attacker doesn't even need an account or login to cause trouble. They can reach the plugin from the outside and start causing damage. Here's what successful exploitation could allow: - Deleting arbitrary files on the server, which can break a site entirely - Extracting sensitive data, including wallet credentials that users trust the site to protect - Doing it all without authentication, so there's no password barrier to slow anyone down Think of it like a back door left wide open. You don't need a key. You just walk in. ### Why Wallet Credentials Are the Real Prize If you run a site that touches crypto, your wallet credentials are the crown jewels. They're the keys to funds that may not be recoverable once they're gone. Unlike a hacked email account, there's no password reset for a drained wallet. That's why this particular flaw deserves more attention than your average plugin bug. The combination of no authentication required and access to wallet credentials is about as bad as it gets. ### What You Should Do Right Now If you're running this plugin, don't wait for a patch to appear on its own. Take action today: - Disable or remove the plugin until a fix is available - Check your server logs for any unusual file deletions or access attempts - Rotate your wallet credentials if you suspect anything touched your site - Keep an eye on official channels for a patched version It also helps to have a backup plan. Literally. Regular backups stored off-server can mean the difference between a bad afternoon and a total loss. ### The Bigger Lesson Here This isn't just about one plugin. It's a reminder that every add-on you install expands your attack surface. A single neglected update can undo a lot of careful security work. So take five minutes today. Look at what's running on your site. Ask yourself which pieces actually need to be there. The fewer doors you leave open, the fewer chances someone gets to walk through one. Stay safe out there, and don't sleep on a 10.0.