WordPress TabaPay Gateway Plugin Unauthenticated Admin Login

The TabaPay Gateway WordPress plugin, up to version 1.4.0, has a vulnerability that allows unauthenticated attackers to log in as any registered user, including an administrator.

This is due to the plugin not validating the payment callback before establishing a session for the associated account.