External risk intelligence

TabaPay Gateway WordPress Plugin Authentication Bypass Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-18031

The vulnerability exists in a WordPress payment gateway plugin. Such plugins are designed to be internet-facing by default to process payment callbacks and facilitate e-commerce transactions, making them readily reachable from the public internet in standard deployments.

Authentication Bypass

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the TabaPay Gateway WordPress plugin that could allow unauthorized access to user accounts, including administrative ones. This issue stems from inadequate validation of payment callback requests, potentially enabling attackers to bypass authentication controls. The primary concern is to confirm if this specific plugin is in use within our environment.

Attackers can log in as any user.
It impacts user account access and data integrity.
Confirm plugin usage and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a crafted request to the vulnerable WordPress site. This request would trick the TabaPay Gateway plugin into establishing a new user session without proper authentication. If successful, the attacker could gain access to any user account, including administrator accounts, on the affected WordPress site.

Unauthenticated access to the website is required.
A crafted request triggers the session establishment.
Risk of account takeover and administrative control.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the TabaPay Gateway WordPress plugin could allow unauthenticated attackers to access any user's account, including administrators, by manipulating the payment callback process. This exposure could potentially impact website access and data integrity when supported by the advisory's conditions.

User accounts and administrator access.
Unauthenticated attackers manipulate payment callbacks.
Unauthorized access and potential data compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the TabaPay Gateway WordPress plugin impacts e-commerce operations and requires coordination between application owners, infrastructure teams, and potentially vendor management if the plugin is externally sourced. The first step is to identify all WordPress sites using this plugin, confirm their internet accessibility and business criticality, and then ascertain the specific owner responsible for each instance to prioritize remediation efforts.

Application owners should prioritize this.
Verify internet-facing instances first.
Plan vendor engagement for remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the TabaPay Gateway WordPress plugin?

The TabaPay Gateway is a software component designed for WordPress sites to handle e-commerce payment processing. It acts as an bridge between a merchant's website and the TabaPay payment infrastructure, allowing the site to receive and process payment status updates or callbacks from the service provider.

What does CWE-287 mean for CVE-2026-18031?

CWE-287 refers to improper authentication. In the context of CVE-2026-18031, it means the plugin fails to verify the identity of the source sending a payment callback. Because the software accepts these incoming requests without confirming they are legitimate, it mistakenly trusts the request, allowing an attacker to bypass standard login security and gain unauthorized access to any account.

How does an attacker trigger this vulnerability?

An attacker exploits this by sending a specifically crafted request to the plugin that mimics a payment callback. The system incorrectly interprets this request as a successful transaction and initiates a user session. Normal user activity or legitimate payment processing that includes valid security tokens does not trigger this flaw; only the specifically crafted, unauthorized requests succeed.

Why is this vulnerability considered highly relevant?

According to Halo Surface Signal, this plugin is inherently internet-facing because it must receive payment callbacks from external services to function. This means any WordPress site using this plugin is directly reachable from the public internet, placing the administrative accounts of these sites at a high risk of unauthorized takeover if they remain unpatched.

Do I need to take action if I use this plugin?

Yes. First, perform an inventory to locate all WordPress sites running the TabaPay Gateway plugin. Once identified, prioritize the most critical, internet-facing sites for review. Since this is an authentication bypass, coordinate with your technical teams to determine if you can disable the plugin or apply a vendor-supplied update immediately to restore proper security controls.

References

wpscan.com/vulnerability/6576dcd1-aea6-47c0-9157-4ca56f426612/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.