CVE-2026-18031
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator.
Risk Assessment
An attacker can gain full access to an administrator account, leading to complete site compromise.
Recommendation
Update the TabaPay Gateway plugin to a version later than 1.4.0 that includes callback validation fixes.
Original NVD description (English source)
The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator.