The TabaPay Gateway WordPress plugin versions up to 1.4.0 contain an improper authentication vulnerability (CWE-287) where the plugin does not validate payment callback requests before creating a session for the associated user account. This flaw enables unauthenticated attackers to impersonate any registered user, including administrators, by exploiting the callback mechanism. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, no privileges required, no user interaction, and full confidentiality, integrity, and availability impact.

Successful exploitation allows an attacker to fully compromise any user account on the affected WordPress site, including administrative accounts. This results in complete control over the site, data confidentiality breaches, data integrity loss, and potential site disruption or defacement.

No official patch or fix is currently documented. Users should monitor the vendor advisory for updates. Until a fix is available, restrict access to the plugin's callback endpoints if possible and consider disabling the plugin if it is not essential. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.