A critical authentication bypass vulnerability in the TabaPay Gateway WordPress plugin allows unauthenticated attackers to gain full administrative access to affected sites.

This flaw is categorized as CWE-287, Improper Authentication, occurring because the plugin fails to validate payment callbacks before establishing a user session. This oversight allows an unauthenticated remote attacker to log in as any registered user on the WordPress site, effectively granting them elevated administrative privileges.

The exploitation of this vulnerability poses a severe risk to business operations, as it grants unauthorized actors total control over the affected WordPress installation. With administrative access, attackers can modify site content, exfiltrate sensitive customer data, inject malicious scripts, or completely disable the platform, resulting in significant reputational damage and potential regulatory penalties. The CVSS score of 9.8 reflects the extreme risk associated with this unauthenticated remote access capability.

Immediate Action: Since no official patch is currently available, the most effective remediation is to deactivate and uninstall the TabaPay Gateway plugin until an updated version is released by the vendor.

Proactive Monitoring: Security teams should review WordPress user access logs for suspicious administrative logins or account modifications occurring outside of normal business hours.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized callback requests and monitor for anomalous traffic patterns directed at payment processing endpoints.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the linked research write-up.

Given the critical nature of this vulnerability and the lack of a vendor-provided patch, immediate action is required to protect the integrity of the affected environment. Administrators must prioritize the removal of the vulnerable plugin and continuously monitor for signs of unauthorized access until a secure version is available for deployment.