Is CVE-2026-18031 being exploited?

No public exploit is currently tracked.

Back

CVE-2026-18031

Description

The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator.