WordPress Plugin Vulnerabilities

TabaPay Gateway <= 1.4.0 - Unauthenticated Account Takeover via Payment Callback

Description

The plugin does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator.

Proof of Concept

Affects Plugins

Plugin icon
tabapay-gateway
No known fix

References

CVE
CVE-2026-18031

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
moonge
Submitter
moonge
Verified
Yes
WPVDB ID
6576dcd1-aea6-47c0-9157-4ca56f426612

Timeline

Publicly Published
2026-08-17 (about 3 days ago)
Added
2026-08-17 (about 2 days ago)
Last Updated
2026-08-19 (about 9 hours ago)

Other

Published
Title
Published
2026-07-20
Title
SMS Alert Order Notifications – WooCommerce < 3.9.8 - Unauthenticated Account Takeover via Unbound OTP Verification in Signup-with-Mobile
Published
2024-10-16
Title
Miniorange OTP Verification with Firebase < 3.6.1 - Authentication Bypass
Published
2023-08-08
Title
FULL - Customer < 2.3 - Subscriber+ Health Check Disclosure
Published
2014-11-01
Title
WP eCommerce <= 3.8.14.3 - Authorisation Bypass
Published
2025-10-14
Title
OwnID Passwordless Login <= 1.3.4 - Authentication Bypass