Description
The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | TabaPay Gateway | ≤ 1.4.0 | — |
References
- https://wpscan.com/vulnerability/6576dcd1-aea6-47c0-9157-4ca56f426612/ exploit vdb-entry technical-description