Paytium CVE-2026-18467

Requires a publicly-exposed [paytium] shortcode payment/donation form on the target WordPress site (attacker-reachable without authentication), and the attacker must submit that form with a crafted $_POST['pt_form_field']['pt-user-role'] value AND complete the resulting Mollie payment flow so the malicious _pt-user-role meta is persisted. The affected code is the unsigned pt_cf_checkout_meta() filter on the pt_meta_values hook in Paytium <=5.0.3 - sites on a version newer than 5.0.3 (changeset 3678569) are not affected. Limiting factors: exploitation depends on completing an actual Mollie transaction (a small cost/friction barrier not captured by UI:N), and requires the site to actually render a Paytium form publicly. Account seizure additionally relies on the standard WordPress lost-password flow being available on the attacker-supplied email.

This is a genuine high-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8 Critical) is well-supported by the described mechanism: an unauthenticated attacker reaches a full-site-takeover primitive by overwriting a signed role value through a second, unsanitized filter (pt_cf_checkout_meta on the pt_meta_values hook) that the 5.0.3 patch overlooked. This is an incomplete-patch/patch-bypass scenario, which raises its credibility as an exploitable defect rather than a theoretical one. No EPSS score, no CISA KEV listing, and no public exploit code were provided (the references are Wordfence's advisory and plugins.trac source-code lines, not a POC), so there is currently no signal of active exploitation. One practical caveat NOT fully reflected in the raw score: exploitation requires submitting AND completing a real Mollie payment through a public [paytium] shortcode form, which is a modest friction/cost barrier and could arguably justify AC:H - verify against the actual payment flow (e.g., whether a minimal or test amount suffices). Net: treat as an urgent patch priority for any site running the plugin, but the payment-completion requirement means opportunistic mass exploitation is somewhat less likely than a typical PR:N/UI:N WordPress priv-esc.

An unauthenticated attacker visits a WordPress site exposing a [paytium] donation/payment form, submits the form with a crafted pt_form_field[pt-user-role]=administrator parameter alongside their own email, and completes the resulting Mollie payment. The plugin's unsigned pt_cf_checkout_meta filter copies the attacker-controlled role into payment meta, overwriting the signed value, so wp_insert_user() creates a new administrator account; the attacker then triggers the standard lost-password flow on their supplied email to seize the account. No public exploit code was identified, though Wordfence has published a detailed technical advisory.