TabaPay Gateway
TabaPay Gateway has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it remains unpatched as of October 2026. Their average CVSS score is 7.3, and the most serious one scores 7.3 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is Improper Privilege Management, behind 1 of the records (100%).
The one issue recorded for TabaPay Gateway has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2026.
All of these findings were reported by moonge. TabaPay Gateway is installed on roughly 30 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2026-18031TabaPay Gateway <= 1.4.0 - Unauthenticated Privilege Escalation
Read the full analysisVulnerability Records
TabaPay – درگاه پرداخت تاباپی
Author
TabaPay
TabaPay connects your WooCommerce store to the TabaPay payment gateway so customers can pay online through Shaparak. After you install the plugin and enter your Merchant Key, TabaPay appears as a payment method at checkout. Customers are redirected to the payment page and then return to your store when the payment is done. Features Works with WooCommerce checkout Secure payments via TabaPay / Shaparak Custom title and description on checkout Supports IRR, IRT, IRHT, and IRHR (amount converted automatically) Saves tracking code, card number, IP, and payment date on the order Sandbox mode for test payments Optional SMS confirmation for the customer Optional automatic tax invoice data (including invoiceProductId mapping) External services This plugin sends payment data to the TabaPay API over HTTPS to create and verify transactions. When a customer starts payment, the plugin may send: Order amount Order ID Callback URL Customer contact details needed for payment / invoice (if enabled) Service provider: tabapay.ir Terms: tabapay.ir/terms-and-conditions Privacy: tabapay.ir/privacy-policy
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C