Description

The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-19T06:17:36.537Z",
  "pubdate": "2026-08-19T06:17:36.537Z",
  "executiveSummary": "The TabaPay Gateway WordPress plugin through 1.4.0 suffers from an authentication bypass vulnerability that allows unauthenticated remote attackers to compromise arbitrary user accounts, including high-privileged administrators.\nThis security flaw stems from an insufficient validation mechanism within the payment callback handling functionality. Specifically, the plugin fails to cryptographically verify or properly validate the authenticity of incoming payment callbacks prior to establishing an authenticated session for the user account associated with the referenced order.\nConsequently, an unauthenticated threat actor can forge or manipulate callback parameters to reference arbitrary order IDs linked to specific user accounts. Upon successful processing of the unvalidated callback, the application automatically instantiates an active session for that user, bypassing standard authentication controls entirely.\nThe impact of this vulnerability is critical, as successful exploitation grants unauthorized full administrative access to the affected WordPress installation. This enables attackers to execute arbitrary code, install malicious plugins, modify site content, and compromise the underlying server infrastructure.\nExploitation requires network access to the target WordPress site's HTTP/HTTPS interface and knowledge of the vulnerable plugin endpoint. No prior authentication, user interaction, or specific privileges are required to mount the attack, significantly elevating the associated risk profile.",
  "technicalDetails": "The vulnerability resides in the payment callback processing mechanism of the TabaPay Gateway WordPress plugin through 1.4.0. The root cause of the security defect is the absence of adequate input validation and cryptographic signature verification on incoming payment notification requests before session establishment routines are triggered.\nDuring a standard transaction lifecycle, payment gateways issue a callback or webhook to the merchant's site to notify them of transaction completion. In the vulnerable component, the software ingests the callback payload containing an order reference but fails to ensure that the request originates legitimately from the TabaPay payment gateway or that the transaction was genuinely authorized and completed successfully.\nThe attack flow proceeds as follows: First, the unauthenticated attacker identifies the publicly exposed callback endpoint associated with the TabaPay Gateway plugin. Second, the attacker crafts a malicious HTTP request directed at this endpoint, supplying manipulated parameters that reference a target order ID within the system. This order ID is inherently associated with a registered user account, such as an administrator.\nThird, the vulnerable component parses the callback data without validating the transaction status or verifying the integrity of the request source. Trusting the supplied order reference, the plugin logic retrieves the associated user account and programmatically initializes an authenticated session for that user.\nFinally, the attacker receives the session cookies or tokens established during this process, granting them complete control over the victim's account. If the targeted order corresponds to an administrative user, the attacker achieves full administrative privileges over the WordPress site.\nThe affected component is the payment callback handling module within the TabaPay Gateway plugin across all versions up to and including 1.4.0. The attack vector is entirely network-based, exposing the application to unauthenticated remote attackers without requiring any prior privileges or user interaction."
}