Privilege Escalation in Pronamic Pay WordPress Plugin

Executive Summary

The Pronamic Pay WordPress plugin up to version 10.1.0 has a privilege escalation flaw. The vulnerability occurs in the maybe_update_user_role() function, which allows attackers with Subscriber-level access or higher to escalate their role to Administrator by manipulating a Gravity Forms field value. This happens because the function passes an attacker-controlled value directly into WP_User::set_role() without validation or permission checks.

Useful 0 Not Useful 0

Detection Guidance

Check WordPress installations for the Pronamic Pay plugin versions up to 10.1.0. Inspect Gravity Forms configurations for payment feeds with the Update User Role option enabled. Look for unauthorized role changes in user accounts, particularly Subscriber-level users escalated to Administrator.

Useful 0 Not Useful 0

Impact Analysis

Authenticated attackers with basic access could take over WordPress sites by upgrading their own accounts to Administrator. This requires an administrator to have previously configured a Pronamic Pay payment feed in Gravity Forms with the Update User Role option enabled. Once exploited, attackers gain full control over the website.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by allowing unauthorized privilege escalation. If exploited, it may lead to unauthorized access to sensitive user data, which is a violation of GDPR's data protection principles and HIPAA's access control requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Pronamic Pay plugin to the latest version. Disable the Update User Role option in Gravity Forms payment feeds. Review user roles for unauthorized changes and remove any suspicious Administrator accounts created by attackers.

Useful 0 Not Useful 0