CVE-2026-16635 Overview
CVE-2026-16635 is a privilege escalation vulnerability in the Pronamic Pay plugin for WordPress, affecting all versions up to and including 10.1.0. The flaw resides in the maybe_update_user_role() function within the Gravity Forms extension. The function passes an attacker-controlled form field value directly into WP_User::set_role() without allowlist validation or capability checks. Authenticated attackers with Subscriber-level access or above can escalate their own accounts to Administrator by tampering with the role field value in a form submission. Exploitation requires that an administrator has previously configured a Pronamic Pay payment feed in Gravity Forms with the Update User Role option enabled and mapped to a form field.
Critical Impact
Authenticated users with minimal privileges can obtain full Administrator control of the WordPress site, leading to complete site compromise.
Affected Products
- Pronamic Pay plugin for WordPress, versions up to and including 10.1.0
- Sites using Pronamic Pay with the Gravity Forms integration
- WordPress installations where the Update User Role feed option is configured
Discovery Timeline
- 2026-08-01 - CVE CVE-2026-16635 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-16635
Vulnerability Analysis
The vulnerability is classified under [CWE-269: Improper Privilege Management]. The Pronamic Pay plugin integrates with Gravity Forms and offers an Update User Role feature that updates a user's WordPress role based on the value of a mapped form field after payment processing. The plugin trusts the form input value as an authoritative role identifier.
When the payment feed processes a lead, maybe_update_user_role() reads $lead[$feed->user_role_field_id] and passes it directly to WP_User::set_role(). WordPress applies whatever role string it receives, including administrator. Because the field value is user-controlled at form submission time, a Subscriber-level attacker can inject the administrator string, causing WordPress to promote their account.
Root Cause
The root cause is missing input validation and authorization control in maybe_update_user_role(). The function does not enforce an allowlist of permissible roles, does not compare the requesting user's capabilities against the role being assigned, and does not verify that the acting user is authorized to change roles. Any string submitted through the mapped Gravity Forms field is accepted as a valid target role.
Attack Vector
Exploitation is remote and network-based. An authenticated attacker with at least Subscriber-level access submits a Gravity Forms entry tied to a Pronamic Pay feed that has the Update User Role option enabled. By tampering with the role field value (for example, using browser developer tools or intercepting the request), the attacker submits administrator as the field value. When the feed processes the submission, the attacker's account is elevated to the Administrator role, granting full control over the WordPress site.
No synthetic exploit code is provided. Technical details are available in the Wordfence Vulnerability Report and the WordPress Plugin Source Code.
Detection Methods for CVE-2026-16635
Indicators of Compromise
- Unexpected role changes in the wp_usermeta table, particularly users promoted to administrator shortly after submitting Gravity Forms entries
- Gravity Forms entry logs containing role strings such as administrator, editor, or author in fields mapped to Pronamic Pay user role updates
- New administrator accounts appearing without corresponding admin-initiated actions in the WordPress audit trail
Detection Strategies
- Audit all Gravity Forms feeds configured through Pronamic Pay for the Update User Role option and review which form fields are mapped
- Correlate Gravity Forms submission timestamps with WordPress role change events to identify suspicious elevation patterns
- Monitor WordPress database changes to the wp_capabilities user meta key for unexpected administrator assignments
Monitoring Recommendations
- Enable WordPress activity logging plugins to capture role changes with the source user and IP address
- Forward WordPress and web server logs to a centralized SIEM for correlation across form submissions and privilege changes
- Alert on any promotion of a Subscriber-level account to a higher-privileged role
How to Mitigate CVE-2026-16635
Immediate Actions Required
- Update the Pronamic Pay plugin to version 10.2.0 or later, which contains the fix committed in changeset 3630401
- Review all Gravity Forms feeds that use Pronamic Pay and disable the Update User Role option where it is not required
- Audit existing user accounts for unauthorized promotions and reset roles for any accounts that were elevated without authorization
Patch Information
The vendor released version 10.2.0 of the Pronamic Pay plugin, which addresses the missing validation in maybe_update_user_role(). See the version diff between 10.1.0 and 10.2.0 for the complete set of changes.
Workarounds
- Disable the Update User Role option in every Pronamic Pay payment feed until the plugin is updated
- Restrict the mapped role field to a hidden or admin-only field type that cannot be modified by form submitters
- Remove or deactivate the Pronamic Pay plugin on sites where the Gravity Forms integration is not in use
# Configuration example: use WP-CLI to identify recently elevated accounts
wp user list --role=administrator --fields=ID,user_login,user_registered,user_email
wp user meta get <user_id> wp_capabilities
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
