TabaPay Gateway CVE-2026-18031

Exploitation requires that the TabaPay Gateway plugin (≤1.4.0) is installed and active and that its payment callback endpoint is reachable by the attacker - which it is by design, since payment processors post callbacks over the network. The attacker must reference an order that is associated with the target account; a valid or guessable/forgeable order reference for the victim user is the practical prerequisite. Limiting factors: the site must actually run this specific plugin (a niche WooCommerce/WordPress payment integration), and the attacker needs a callback that maps to the intended victim's account, so account takeover is targeted per-order rather than blind. Beyond that, per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there is no authentication and no user interaction required.

The signals are mixed but lean toward genuine priority for anyone running this plugin. CVSS 3.1 is 9.8 with AV:N/AC:L/PR:N/UI:N - network-reachable, low complexity, no authentication, no user interaction - and impact is Confidentiality/Integrity/Availability all High because logging in as an administrator equals full site takeover. CISA SSVC reinforces this: Automatable=yes and Technical Impact=total, meaning the attack can be scripted at scale and yields complete control. The counterweight is exploitation maturity: SSVC Exploitation=none, there is no CISA KEV listing, and EPSS is only 0.15% (4th percentile), so widespread active exploitation is not currently observed. The low EPSS reflects the plugin's small install base rather than any difficulty of exploitation - the technical bar is very low. Net: not yet actively exploited in the wild, but a high-severity, easily weaponizable auth bypass that should be remediated promptly on any affected site.

An attacker identifies a WordPress site running TabaPay Gateway ≤1.4.0 and sends a crafted payment-callback request to the plugin's callback endpoint that references an order associated with the site's administrator account. The plugin establishes an authenticated session for that account without verifying the callback, handing the attacker an admin session; from there they install a malicious plugin or web shell for full site compromise. No proof-of-concept is published, but the low attack complexity (AC:L) and lack of required authentication or user interaction make development straightforward.