CVE-2026-18467 in Paytium Mollie payment forms & donations Plugin
Summary
by MITRE • 09/24/2026
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.3. The 5.0.3 patch introduced a wp_hash()/hash_equals() signature gate on the pt-paytium-user-data field, but left a second filter — pt_cf_checkout_meta(), registered on the pt_meta_values hook after the signed builder — that copies every $_POST['pt_form_field'][*] key verbatim into the payment meta array without any signature verification; this allows the pt-user-role value it copies to overwrite the signed path's output, after which paytium_user_data_processing() reads the persisted _pt-user-role post meta and passes it directly as the role argument to wp_insert_user(). This makes it possible for unauthenticated attackers to register a new WordPress account with the administrator role and fully take over the site. Exploitation requires submitting a payment through a publicly-exposed [paytium] shortcode form and completing the resulting payment flow, after which the attacker can seize the new administrator account via the standard lost-password flow on their supplied email address.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The Paytium plugin for WordPress contains a critical privilege escalation vulnerability affecting all versions up to and including 5.0.3. This flaw stems from an incomplete implementation of security controls designed to prevent unauthorized modification of user data during the payment processing workflow. While version 5.0.3 introduced a protective mechanism using wp_hash() and hash_equals() to validate the signature of the pt-paytium-user-data field, it failed to apply similar verification logic to other fields processed within the same transaction flow. Specifically, the plugin registers a filter on the pt_meta_values hook via the function pt_cf_checkout_meta(), which operates after the signed builder has completed its validation. This architectural oversight creates a secondary input vector that bypasses the integrity checks applied to the primary user data field.
The technical core of this vulnerability lies in how the plugin handles form submission data. The pt_cf_checkout_meta() function iterates through every key present in the $_POST['pt_form_field'] array and copies these values verbatim into the payment meta array without performing any signature verification or integrity checks. Among these fields is a specific parameter named pt-user-role, which dictates the WordPress user role assigned to new accounts created during the registration process. Because this field is not subject to the same cryptographic validation as the signed data, an attacker can manipulate its value in transit. When the paytium_user_data_processing() function subsequently executes, it retrieves the persisted _pt-user-role post meta and passes it directly as the role argument to wp_insert_user(). This direct assignment allows a malicious actor to override the intended default or calculated user role with any arbitrary WordPress capability level.
The operational impact of this vulnerability is severe, enabling unauthenticated attackers to achieve full administrative control over the targeted WordPress installation. To exploit this flaw, an attacker must submit a payment through a publicly exposed [paytium] shortcode form and complete the resulting payment flow. This process does not require prior authentication or valid credentials, making it accessible to any internet user who can reach the site's public-facing pages. Once the transaction is processed with a manipulated pt-user-role value set to administrator, the system creates a new WordPress account for the attacker with full administrative privileges. The attacker then utilizes the standard lost-password flow associated with their supplied email address to reset the password and gain persistent access to the backend of the website.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, as it allows a user to elevate their permissions beyond what is intended by the system design. Furthermore, from an ATT&CK perspective, this exploitation technique corresponds to T1078 Valid Accounts and potentially T1136 Create Account, as the attacker creates a new privileged account through legitimate application functionality that has been subverted. The lack of input validation on critical configuration fields represents a significant deviation from secure coding practices recommended by industry standards such as OWASP Top 10, specifically regarding Broken Access Control and Security Misconfiguration.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. Administrators should immediately update the Paytium plugin to version 5.0.4 or later, where this specific filter logic has been corrected to ensure all user-related fields undergo signature verification before being processed into the payment meta array. In cases where updating is not immediately feasible, administrators can implement a temporary workaround by disabling public-facing forms that allow unauthenticated registration until the patch is applied. Additionally, security audits should review other plugins for similar patterns of verbatim data copying without integrity checks to prevent analogous privilege escalation vectors in future deployments.