CVE-2026-18467
Received Received - Intake

Privilege Escalation in Paytium WordPress Plugin

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: Wordfence

Description
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.3. The 5.0.3 patch introduced a wp_hash()/hash_equals() signature gate on the pt-paytium-user-data field, but left a second filter — pt_cf_checkout_meta(), registered on the pt_meta_values hook after the signed builder — that copies every $_POST['pt_form_field'][*] key verbatim into the payment meta array without any signature verification; this allows the pt-user-role value it copies to overwrite the signed path's output, after which paytium_user_data_processing() reads the persisted _pt-user-role post meta and passes it directly as the role argument to wp_insert_user(). This makes it possible for unauthenticated attackers to register a new WordPress account with the administrator role and fully take over the site. Exploitation requires submitting a payment through a publicly-exposed [paytium] shortcode form and completing the resulting payment flow, after which the attacker can seize the new administrator account via the standard lost-password flow on their supplied email address.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-18467
EUVD
EUVD-2026-85777

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
paytium paytium to 5.0.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a privilege escalation vulnerability in the Paytium plugin for WordPress. It allows unauthenticated attackers to register a new WordPress account with administrator privileges by exploiting a flaw in how user role data is handled during payment processing. The issue stems from a missing signature check on certain form fields, enabling attackers to overwrite the intended user role with an admin role.

Detection Guidance

This vulnerability requires checking WordPress sites using the Paytium plugin for unauthorized administrator account creation. Inspect WordPress user roles via the admin panel or database for unexpected admin accounts. Review server logs for suspicious payment form submissions through [paytium] shortcodes.

Impact Analysis

If exploited, this vulnerability allows attackers to gain full control of your WordPress site by creating an admin account. They can then install malicious plugins, steal data, deface your site, or use it for further attacks. The attack requires submitting a payment through a public payment form, making sites with exposed payment forms particularly vulnerable.

Compliance Impact

This vulnerability allows unauthenticated attackers to escalate privileges to administrator level on WordPress sites using the Paytium plugin. This could lead to unauthorized access to sensitive data, violating GDPR and HIPAA compliance requirements for data protection and access controls.

Mitigation Strategies

Update the Paytium plugin to the latest version beyond 5.0.3 immediately. Disable the plugin if an update is not available. Review WordPress user accounts for unauthorized administrator role assignments.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18467. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart