CVE-2026-18031: TabaPay Gateway <= 1.4.0 - Unauthenticated Account Takeover via Payment Callback

Q: Who can exploit this issue?

An unauthenticated attacker can exploit it. The attacker can log in as any registered user, including an administrator, by abusing the payment callback handling for a referenced order.

Q: Which installations are affected?

The affected software is the TabaPay Gateway WordPress plugin through version 1.4.0. The provided information does not identify any configuration prerequisite or exception.

Q: What is the impact if exploitation succeeds?

Successful exploitation establishes a session for the account associated with the referenced order. This can result in full account takeover, including takeover of administrator accounts.

Published Aug 19, 2026

Updated

The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator.

Affected Software

1 affected component

TabaPay Gateway WordPress plugin<=1.4.0

Event History

Aug 19, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated attacker can exploit it. The attacker can log in as any registered user, including an administrator, by abusing the payment callback handling for a referenced order.

Which installations are affected?

The affected software is the TabaPay Gateway WordPress plugin through version 1.4.0. The provided information does not identify any configuration prerequisite or exception.

What is the impact if exploitation succeeds?

Successful exploitation establishes a session for the account associated with the referenced order. This can result in full account takeover, including takeover of administrator accounts.