What is CVE-2026-18031?
The TabaPay Gateway WordPress plugin up to version 1.4.0 does not validate the payment callback. This vulnerability allows unauthenticated attackers to log in as any registered user, including an administrator, by exploiting the unvalidated callback to establish a session. It is recommended to update the plugin to the latest version immediately.
Related CVEs
link basis: same weakness class CWE-287
FAQ2
Which versions of the TabaPay Gateway plugin are affected by CVE-2026-18031?
All versions up to and including 1.4.0 are affected.
What can an unauthenticated attacker do by exploiting CVE-2026-18031?
By exploiting the unvalidated payment callback, an attacker can log in as any registered user, including an administrator.
See also6
grounded ✓NVD ↗
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.