CVE-2026-18467: Paytium WordPress Plugin Privilege Escalation

CVE-2026-18467 Overview

CVE-2026-18467 is a privilege escalation vulnerability in the Paytium: Mollie payment forms & donations plugin for WordPress, affecting all versions up to and including 5.0.3. The flaw stems from an incomplete patch that left an unsigned secondary filter capable of overwriting role data processed by the plugin's user registration workflow. Unauthenticated attackers can submit a payment through any publicly exposed [paytium] shortcode form and register a new WordPress account with administrator privileges. The weakness is tracked under CWE-269: Improper Privilege Management.

Critical Impact
Unauthenticated attackers can gain full administrative control of affected WordPress sites by completing a single payment flow and then triggering a password reset.

Affected Products

Paytium: Mollie payment forms & donations plugin for WordPress
All versions up to and including 5.0.3
WordPress sites exposing the [paytium] shortcode publicly

Discovery Timeline

2026-09-24 - CVE-2026-18467 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-18467

Vulnerability Analysis

The Paytium plugin version 5.0.3 introduced a wp_hash()/hash_equals() signature gate on the pt-paytium-user-data field to prevent tampering with user registration parameters. The patch is incomplete. A second filter, pt_cf_checkout_meta(), registered on the pt_meta_values hook, runs after the signed builder and copies every $_POST['pt_form_field'][*] key verbatim into the payment meta array. No signature verification occurs on this second path.

Attackers supply a pt-user-role key in the unsigned pt_form_field input. The value overwrites the output produced by the signed builder. The paytium_user_data_processing() function then reads the persisted _pt-user-role post meta and passes it directly as the role argument to wp_insert_user(), creating a WordPress account with the attacker-controlled role.

Root Cause

The root cause is improper privilege management combined with an incomplete security control. The signature gate on pt-paytium-user-data validates one input path while a parallel, unauthenticated filter writes to the same meta array. Trust decisions made by the signed path are nullified by the subsequent unsigned write, allowing privilege data to be forged by any site visitor.

Attack Vector

Exploitation requires network access to a public [paytium] shortcode form. The attacker submits the form with an additional pt_form_field[pt-user-role] parameter set to administrator, supplies an attacker-controlled email address, and completes the Mollie payment flow. Once the payment finalizes, the plugin provisions a new administrator account tied to that email. The attacker then uses the standard WordPress lost-password flow to seize the account.

See the Wordfence Vulnerability Report and the vulnerable paths in user-data-functions.php and process-payment-functions.php for technical details.

Detection Methods for CVE-2026-18467

Indicators of Compromise

Unexpected WordPress user accounts created with the administrator role shortly after a Paytium payment event.
Post meta entries named _pt-user-role containing non-default role values such as administrator or editor.
Password reset emails sent to unfamiliar external addresses immediately after new user registration.
HTTP POST requests to Paytium endpoints containing a pt_form_field[pt-user-role] parameter.

Detection Strategies

Audit the wp_users and wp_usermeta tables for recently created administrator accounts correlated with Paytium order IDs.
Inspect web server access logs for POST requests to pages hosting the [paytium] shortcode that include pt-user-role in the request body.
Review Paytium order post meta for the presence of _pt-user-role keys with privileged role values.

Monitoring Recommendations

Alert on any WordPress user_register event where the assigned role is administrator and the registration originated from a front-end payment flow.
Monitor outbound mail for password reset messages sent to external domains following new administrator provisioning.
Track plugin version inventory across WordPress estates and flag any instance of Paytium at version 5.0.3 or lower.

How to Mitigate CVE-2026-18467

Immediate Actions Required

Update the Paytium plugin to a version later than 5.0.3 as soon as the vendor publishes a corrected release.
Audit all WordPress administrator accounts and remove any unrecognized users created through payment flows.
Invalidate active sessions and force password resets for all administrators on affected sites.
Review Mollie transaction logs for suspicious low-value payments correlated with account creation events.

Patch Information

The 5.0.3 release attempted to fix the original issue via a signature gate but left the pt_cf_checkout_meta() filter unprotected. Monitor the Paytium plugin changeset history and the vendor advisory for a corrected patch that applies signature verification to the pt_meta_values hook or strips the pt-user-role key from the unsigned input path.

Workarounds

Temporarily deactivate the Paytium plugin on public-facing WordPress sites until a complete fix is available.
Remove or restrict access to pages containing the [paytium] shortcode using capability checks or IP allowlists.
Deploy a web application firewall rule that blocks POST requests containing pt_form_field[pt-user-role] or similar role parameters.
Disable WordPress user registration (Settings → General → Membership) to limit account creation surface area.

bash

# Example WAF rule to block role parameter injection in Paytium submissions
SecRule REQUEST_METHOD "@streq POST" \
  "chain,phase:2,id:1002026184670,deny,status:403,log,msg:'Paytium pt-user-role tampering (CVE-2026-18467)'"
  SecRule ARGS_NAMES "@rx pt_form_field\[pt-user-role\]" "t:none,t:lowercase"