{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/paytium/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:paytium:paytium_mollie_payment_forms_donations:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-18467"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Paytium: Mollie payment forms \u0026 donations (\u003c= 5.0.3)"],"_cs_severities":["critical"],"_cs_tags":["wordpress","vulnerability","privilege-escalation"],"_cs_type":"advisory","_cs_vendors":["Paytium"],"content_html":"\u003cp\u003eThe Paytium: Mollie payment forms \u0026amp; donations plugin for WordPress (versions 5.0.3 and below) is susceptible to a critical privilege escalation vulnerability. Although the 5.0.3 patch implemented signature verification on the pt-paytium-user-data field, it failed to apply the same rigor to the pt_cf_checkout_meta function. This function, registered on the pt_meta_values hook, allows attackers to inject arbitrary keys from the $_POST['pt_form_field'] array into the payment meta array. An attacker can supply a pt-user-role key, which subsequently overwrites the legitimate data processed by the plugin. When paytium_user_data_processing is invoked, it reads this unauthorized meta and passes the value directly into the wp_insert_user function. This flaw allows an unauthenticated visitor to register a new account on a site and force the system to assign it the 'administrator' role, leading to full site compromise.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to elevate their privileges to the administrator level, granting them complete control over the affected WordPress installation. This enables the theft of site data, installation of malicious backdoors, and total administrative takeover of the targeted website.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eImmediately upgrade the Paytium: Mollie payment forms \u0026amp; donations plugin to a version patched beyond 5.0.3.\u003c/li\u003e\n\u003cli\u003eAudit existing WordPress user accounts for suspicious administrators created or modified recently.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for POST requests targeting [paytium] shortcode form submission endpoints that include unexpected role-related metadata parameters.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-24T02:45:44Z","date_published":"2026-09-24T02:45:44Z","id":"https://feed.craftedsignal.io/briefs/2026-09-paytium-privesc/","summary":"The Paytium: Mollie payment forms \u0026 donations plugin for WordPress contains an unauthenticated privilege escalation vulnerability allowing attackers to register as site administrators.","title":"Privilege Escalation in Paytium WordPress Plugin via Improper Meta Handling","url":"https://feed.craftedsignal.io/briefs/2026-09-paytium-privesc/"}],"language":"en","title":"CraftedSignal Threat Feed - Paytium","version":"https://jsonfeed.org/version/1.1"}