Privilege Escalation in Paytium WordPress Plugin via Improper Meta Handling

The Paytium: Mollie payment forms & donations plugin for WordPress (versions 5.0.3 and below) is susceptible to a critical privilege escalation vulnerability. Although the 5.0.3 patch implemented signature verification on the pt-paytium-user-data field, it failed to apply the same rigor to the pt_cf_checkout_meta function. This function, registered on the pt_meta_values hook, allows attackers to inject arbitrary keys from the $_POST['pt_form_field'] array into the payment meta array. An attacker can supply a pt-user-role key, which subsequently overwrites the legitimate data processed by the plugin. When paytium_user_data_processing is invoked, it reads this unauthorized meta and passes the value directly into the wp_insert_user function. This flaw allows an unauthenticated visitor to register a new account on a site and force the system to assign it the 'administrator' role, leading to full site compromise.

Impact

Successful exploitation allows unauthenticated attackers to elevate their privileges to the administrator level, granting them complete control over the affected WordPress installation. This enables the theft of site data, installation of malicious backdoors, and total administrative takeover of the targeted website.

Recommendation

1. Immediately upgrade the Paytium: Mollie payment forms & donations plugin to a version patched beyond 5.0.3.
2. Audit existing WordPress user accounts for suspicious administrators created or modified recently.
3. Monitor web server logs for POST requests targeting [paytium] shortcode form submission endpoints that include unexpected role-related metadata parameters.