Unauthenticated Session Hijacking via Payment Callback Bypass

The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The TabaPay Gateway WordPress plugin vulnerability (CVE-2026-18031) represents a critical authentication bypass flaw affecting versions through 1.4.0. The plugin fails to validate payment callbacks before creating user sessions, enabling attackers to impersonate any registered user—including administrators—without credentials. This vulnerability is particularly dangerous because payment gateways are trusted components in e-commerce ecosystems; attackers exploit this trust by crafting malicious callback requests that trigger session creation for arbitrary accounts. Any WordPress site using this plugin becomes an entry point for complete account compromise, data theft, and administrative takeover.

Casky's 283 matched skills detect the attack patterns underlying this CVE by analyzing indicators across MITRE ATT&CK's Initial Access (TA0004) and Credential Access (TA0006) tactics. Practitioners using Casky would identify suspicious patterns including: unauthenticated callback requests lacking cryptographic validation, session tokens generated without prior login verification, and account access logs showing login events with no corresponding authentication attempts. Claude's extended reasoning capability correlates these disparate signals—examining request origins, callback parameter manipulation, and session establishment timelines—to surface the root cause: missing authentication checks before session binding. Security teams receive actionable findings highlighting where callback validation should occur, enabling rapid remediation before attackers weaponize this trust-based bypass.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-18031.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-18031

Casky has 283 skills that investigate the attack patterns behind CVE-2026-18031. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn