CVE-2026-18031 is an improper authentication vulnerability (CWE-287) in the TabaPay Gateway WordPress plugin through version 1.4.0. The plugin fails to validate payment callbacks before creating a session for the user associated with the referenced order. This allows unauthenticated attackers to log in as any registered user, including administrative accounts, potentially leading to full site compromise. The vulnerability is publicly disclosed but lacks a CVSS score and no patch or fix has been confirmed. The plugin is not a cloud service, so remediation depends on vendor or user action.

Successful exploitation allows an unauthenticated attacker to impersonate any registered user, including administrators, by bypassing authentication checks on payment callbacks. This can lead to unauthorized access, privilege escalation, and full control over the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the TabaPay Gateway plugin or restricting access to payment callback endpoints if possible. Monitor official vendor channels for updates.