CVE-2026-18467: Paytium: Mollie payment forms & donations <= 5.0.3 - Unauthenticated Privilege Escalation via 'pt_form_field[pt-user-role]' Parameter
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.3. The 5.0.3 patch introduced a wphash()/hashequals() signature gate on the pt-paytium-user-data field, but left a second filter — ptcfcheckoutmeta(), registered on the ptmetavalues hook after the signed builder — that copies every $POST['ptformfield'][] key verbatim into the payment meta array without any signature verification; this allows the pt-user-role value it copies to overwrite the signed path's output, after which paytiumuserdataprocessing() reads the persisted pt-user-role post meta and passes it directly as the role argument to wpinsertuser(). This makes it possible for unauthenticated attackers to register a new WordPress account with the administrator role and fully take over the site. Exploitation requires submitting a payment through a publicly-exposed [paytium] shortcode form and completing the resulting payment flow, after which the attacker can seize the new administrator account via the standard lost-password flow on their supplied email address.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to exploitation?
Sites running the affected plugin version 5.0.3 or earlier are exposed if they have a publicly accessible payment form rendered through a [paytium] shortcode. The attacker does not need an existing WordPress account.
What does an attacker need to do to exploit this issue?
The attacker must submit a payment through an exposed form and complete the resulting payment flow. They can supply a pt-user-role value that results in a newly registered WordPress account receiving the administrator role, then use the standard lost-password process for the email address they provided.
Does the signature protection added in version 5.0.3 prevent exploitation?
No. Although 5.0.3 added signature verification for pt-paytium-user-data, a later filter copies pt_form_field values into payment metadata without signature verification, allowing pt-user-role to overwrite the protected value.
How can I determine whether a site may already have been compromised?
Review WordPress user accounts for unexpected administrator users, particularly newly created accounts associated with payment form submissions. Also review payment records and related metadata for unexpected _pt-user-role values or suspicious registration activity.