A critical privilege escalation flaw (CVSS 9.8) in the Paytium: Mollie payment forms & donations plugin for WordPress, versions up to and including 5.0.3, lets unauthenticated attackers register an administrator account and take over the site.
What Is It
CVE-2026-18467 is a privilege escalation vulnerability (CWE-269) in the Paytium WordPress plugin. Version 5.0.3 added a wp_hash()/hash_equals() signature check to the pt-paytium-user-data field. That patch missed a second filter, pt_cf_checkout_meta(). This filter runs on the pt_meta_values hook after the signed builder. It copies every $_POST['pt_form_field'][*] key into the payment meta array without checking any signature.
An attacker can therefore submit a pt-user-role value that overwrites the output of the signed path. Later, paytium_user_data_processing() reads the stored _pt-user-role post meta and passes it straight to wp_insert_user() as the role argument.
Why It Matters
Wordfence scores this CVSS 3.1 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The attack requires no authentication and no user interaction. An attacker can create a new WordPress account with the administrator role and take full control of the site.
To exploit it, an attacker submits a payment through a public [paytium] shortcode form and completes the payment flow. They then use the standard WordPress lost-password flow on the email address they supplied to take control of the new administrator account.
This CVE has no CISA KEV entry, so there is no KEV confirmation of active exploitation.
What's Vulnerable
- Vendor: paytiumsupport
- Product: Paytium: Mollie payment forms & donations (WordPress plugin)
- Affected versions: all versions up to and including 5.0.3
Sites are exposed if they publish a [paytium] shortcode form.
Patch Status
The NVD record lists every version through 5.0.3 as affected. The record does not name a fixed version, but it does reference WordPress plugin changeset 3678569 for Paytium. There is no KEV entry, so CISA has published no required action or due date.
Administrators should: - check which Paytium version they run - look for a release later than 5.0.3 that includes the fix - review WordPress user accounts for administrators they don't recognise, especially any created through payment forms
The NVD record was published on 2026-09-24 with status "Received."
Sources
- NVD, CVE-2026-18467
- Wordfence Threat Intel advisory
- WordPress Plugin Trac; Paytium changeset 3678569
- Plugin Trac; process-payment-functions.php (5.0.3, L21)
- Plugin Trac; process-payment-functions.php (5.0.3, L696)
- Plugin Trac; process-payment-functions.php (5.0.3, L1103)
- Plugin Trac; payment-functions.php (5.0.3, L113)
- Plugin Trac; user-data-functions.php (5.0.3, L214)