critical9.8
CVE-2026-18031
The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the ref…
Impact
The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator.
Affected products
| Product | Affected versions |
|---|---|
| TabaPay Gateway WordPress Plugin | through 1.4.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.