CVE-2026-18031
Received Received - Intake

Session Hijacking via Unvalidated Payment Callback in TabaPay Gateway WordPress Plugin

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: WPScan

Description
The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-18031
EUVD
EUVD-2026-62276

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
tavaplay taba_pay_gateway 1.4.0
tabapay taba_pay_gateway to 1.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The TabaPay Gateway WordPress plugin through version 1.4.0 has a vulnerability where it does not validate payment callbacks before creating a session for the associated user account. This allows unauthenticated attackers to log in as any registered user, including administrators, without needing valid credentials.

Detection Guidance

Check if the TabaPay Gateway WordPress plugin version 1.4.0 or below is installed on your system. You can do this by inspecting the plugin files in the /wp-content/plugins/taba_pay_gateway/ directory or by using WordPress admin panel to view installed plugins.

Impact Analysis

This vulnerability allows attackers to gain unauthorized access to any user account on the affected WordPress site, including admin accounts. This could lead to data theft, unauthorized transactions, website defacement, or complete site takeover.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, violating compliance requirements under GDPR and HIPAA. It may result in data breaches, unauthorized disclosures, and failure to maintain data integrity and confidentiality.

Mitigation Strategies

Immediately deactivate and remove the TabaPay Gateway WordPress plugin from your system if it is installed. Since no fix is available, disabling the plugin is the only way to prevent exploitation until an update is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18031. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart