```
Attackers are already attempting to exploit a maximum-severity vulnerability in the CryptoPayment Gateway WordPress plugin, and no fix has shipped — leaving site operators with no patch to apply and, effectively, no disclosure window to plan around.
Research from Defused Cyber, reported by The Hacker News, identifies the issue as CVE-2026-81648, which carries a CVSS base score of 10.0. According to the findings, successful exploitation allows an unauthenticated visitor — that is, someone with no account and no credentials — to delete arbitrary files on the hosting server and extract sensitive data reported to include wallet credentials.
What a 10.0 means in practice
A perfect severity score is uncommon, and here it reflects the combination that makes the bug dangerous: no authentication required, plus two damaging outcomes.
The file-deletion half means an attacker can strip a site of configuration, themes, plugins, or the media library — enough to take a payment page offline or destroy forensic evidence on the box itself. The extraction half points to the reason this plugin specifically is a target: it handles payment and wallet-related material, so whatever the plugin can read, a remote unauthenticated party may be able to pull out.
Because the flaw is unpatched, there is no vendor fix to fall back on. Until one arrives, compensating controls are the only available defence.
Compensating controls while the plugin stays unpatched
- Disable the plugin entirely if payments can be routed another way. This is the single most effective step, and it removes the attack surface regardless of what else is configured.
- Block the exploit path at the edge. Web application firewall or CDN rules denying unauthenticated requests to the plugin's endpoints can stop opportunistic scanning while the plugin remains installed.
- Harden administrative access. Enforce multi-factor authentication for all WordPress accounts, restrict the admin area by IP where feasible, and audit current user roles for unnecessary privileges.
- Move backups off-host. Because the vulnerability can delete files server-side, backups stored in the same document root are not backups. Confirm that off-site, off-host copies exist and are restorable — and check them for integrity, since a deletion attack may have already reached them.
- Review logs. Look for unusual POST traffic or file operations touching the plugin directory, and preserve logs externally; the bug's file-deletion capability means on-server records may not survive an incident.
- Rotate secrets. Credentials, API keys, and wallet configuration exposed through the plugin should be treated as compromised and reissued, not merely monitored.
One operational detail worth stressing: unattended or automatic WordPress updates can silently fail. Before re-enabling any plugin after remediation, verify the patched version is genuinely installed — check the version number on the plugins screen and confirm it matches the vendor's release notes.
The wider picture
The uncomfortable part of CVE-2026-81648 is not the score; it is the timeline. The usual sequence — disclosure, vendor patch, operator patching — assumes a gap in which defenders can act. With exploitation attempts already underway and no fix published, that gap does not exist. Operators running the plugin are being asked to defend against a live attack with configuration changes alone.
It is a reminder that for payment-adjacent software, disclosure-to-exploit intervals are compressing, and that the value of a patch advisory depends entirely on it arriving before the exploit does.
The report from Defused Cyber makes no reference to any local jurisdiction, but the story is broadly relevant to Hong Kong IT professionals running WordPress-based payment or fintech front ends: the flaw sits squarely in the stack many smaller payment deployments are built on, and the mitigations above apply regardless of location.
The Hacker News carried the Defused Cyber findings; patch status and affected-installation figures should be re-checked against the vendor's channels at time of publication, as either may have changed since disclosure.
```
攻擊者已嘗試利用 CryptoPayment Gateway WordPress 外掛中一個最高嚴重程度的漏洞，而修補程式至今仍未發布——網站營運者既無補丁可套用，事實上亦沒有披露緩衝期可供規劃應對。
Defused Cyber 的研究（由 The Hacker News 報道）將該問題確認為 CVE-2026-81648，其 CVSS 基礎評分為 10.0。根據調查結果，成功利用該漏洞可讓一名未經身份驗證的訪客——即沒有帳戶、沒有任何憑證的人——刪除託管伺服器上的任意檔案，並抽取敏感數據，據報導包括錢包憑證。
10.0 評分在實務上意味著什麼
完美的嚴重程度評分十分罕見，在此它反映了令此漏洞危險的組合：毋須身份驗證，加上兩種具破壞性的後果。
刪除檔案的部分意味著攻擊者可將網站的配置、主題、外掛或多媒體庫一併移除——足以令付款頁面停擺，或摧毀主機本身的法證證據。抽取數據的部分則指向為何此特定外掛會成為目標：它處理付款及錢包相關資料，因此凡外掛可讀取的內容，遠端未經驗證的一方均可能將其取出。
由於漏洞尚未修補，並無供應商修復方案可依賴。在修補程式推出之前，補償性控制措施（compensating controls）是唯一可用的防禦手段。
外掛未獲修補期間的補償性控制措施
- 完全停用外掛，前提是付款可以改由其他途徑處理。這是最有效的單一步驟，而且無論其他配置如何，均可一併消除攻擊面。
- 在邊緣層封堵漏洞利用路徑。 利用 web application firewall（WAF）或 CDN 規則拒絕未經身份驗證的請求存取外掛端點，可在安裝期間阻止機會式掃描。
- 強化管理層存取控制。 為所有 WordPress 帳戶強制實施 multi-factor authentication（MFA），可行情況下限制管理後台的 IP 存取，並審核現有用戶角色是否存在不必要的權限。
- 將備份移離主機。 由於漏洞可在伺服器端刪除檔案，儲存在同一 document root 內的備份並不能算是備份。確認異地、異機副本存在且可還原——並檢查其完整性，因為刪除攻擊可能已波及這些備份。
- 審查日誌。 尋找異常的 POST 流量或涉及外掛目錄的檔案操作，並將日誌保存於外部；該漏洞具備刪除檔案的能力，意味著伺服器上的記錄可能無法在事件中得以保留。
- 更換機密資訊。 透過外掛外洩的憑證、API key 及錢包配置，應視為已被入侵並重新簽發，而不僅是監控。
有一項營運維護細節值得強調：無人值守或自動的 WordPress 更新可能悄無聲息地失敗。在補救後重新啟用任何外掛之前，須核實已真正安裝修補版本——在 plugins 畫面檢查版本號，並確認與供應商的 release notes 一致。
更宏觀的圖景
CVE-2026-81648 最令人不安之處不在於評分，而在於時間表。慣常的流程——披露、供應商發佈補丁、營運者套用補丁——預設中間存在一段防禦方可採取行動的間隙。然而在漏洞利用嘗試已經展開、修補方案尚未發布的情況下，這段間隙根本不存在。仍在使用該外掛的營運者，被要求僅憑配置變更來抵禦一場正在進行的攻擊。
這提醒我們：對於支付相關軟件而言，從披露到遭利用的間隔正不斷收窄，而一份 patch advisory 的價值，完全取決於它能否在 exploit 出現之前送達。
Defused Cyber 的報告未提及任何特定司法管轄區，但相關事件對在香港營運 WordPress 支付或金融科技前端的 IT 專業人士廣泛適用：該漏洞正好位於許多小型支付部署所依賴的技術堆疊之中，而上述緩解措施不分地域同樣適用。
The Hacker News 刊載了 Defused Cyber 的調查結果；補丁狀態及受影響安裝數字，應於發表時根據供應商渠道重新核實，因相關數據可能自披露以來已有變動。