EUVD-2026-39693
GHSA-h9xr-fprq-hcr8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running Paytium ≤5.0.2
-
DeliverySend unauthenticated request to vulnerable endpoint
-
ExploitTrigger incorrect privilege assignment
-
ExecutionObtain elevated/admin privileges
-
ImpactTake over site or alter payment data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Privilege assignment review
|
| Exploitation Conditions | The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no special conditions are required beyond network reachability - remote unauthenticated exploitation against affected installations of the Paytium WordPress plugin (versions <= 5.0.2). The primary limiting factor is that the Paytium plugin must be installed and active on the target WordPress site; the description does not name a specific non-default feature, configuration toggle, or deployment mode as a prerequisite, and no user interaction or authentication is needed. Defenders should note that the precise vulnerable endpoint and any role/registration settings that influence exploitability are not detailed in the provided data and should be verified against the Patchstack advisory. |
| Impact | The signals are partially mixed. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a remote, unauthenticated, low-complexity attack with high impact across all three security properties, which on paper is a top-priority issue. However, several corroborating risk signals are absent from the provided data: no EPSS score was supplied, the vulnerability is not present in CISA KEV (no confirmed active exploitation), and no proof-of-concept or public exploit was indicated - so this remains 'no public exploit identified at time of analysis.' No SSVC decision data (exploitation status, automatable, technical impact) was provided. The single source is a Patchstack advisory, which is a reputable WordPress-vulnerability research source but represents one feed rather than independent cross-confirmation. Net assessment: treat as high priority due to unauthenticated network reach and severe impact, but the real-world urgency cannot be sharpened without EPSS, KEV, or POC data - patch promptly while recognizing that widespread mass-exploitation is not yet evidenced. |
| Exploit ScenarioDerived | An anonymous remote attacker sends a crafted HTTP request to the vulnerable Paytium endpoint on a WordPress site, abusing the flawed privilege-assignment logic to grant themselves or a newly created account elevated rights without authenticating. With elevated privileges they can manipulate site data, payment configuration, or pivot toward full site takeover. No public proof-of-concept is currently identified, so this scenario is inferred from the CVSS vector (network, low complexity, no privileges, no user interaction). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 26, 2026
Unauthenticated privilege escalation in the Paytium WordPress plugin (Mollie payment forms and donations) through version 5.0.2 allows remote attackers with no authentication to gain elevated privileges, with CVSS 9.8 indicating full compromise of confidentiality, integrity, and availability. The flaw stems from incorrect privilege assignment (CWE-266), meaning a low- or no-privilege actor can be granted rights they should not have. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
RemediationAI
No vendor-released patch version is identified in the available data, so confirm the current fixed release directly via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/paytium/vulnerability/wordpress-paytium-plugin-5-0-2-privilege-escalation-vulnerability?_s_id=cve) and the plugin's WordPress.org page, then upgrade to the first release above 5.0.2 once published. Until a fix is confirmed and applied, compensating controls include deactivating and removing the Paytium plugin entirely if payment functionality is not currently required (trade-off: payment/donation forms go offline), or placing the site behind a WordPress-aware web application firewall (such as Patchstack's own virtual patching) to block anonymous requests to the plugin's privilege-affecting endpoints (trade-off: virtual patches may lag and require tuning). Additionally, restrict access to wp-admin and registration endpoints and audit user accounts and roles for unexpected privilege grants created during the exposure window (trade-off: account auditing is manual but catches prior abuse).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Paytium is a WordPress plugin that integrates Mollie to build payment, subscription, and donation forms on WordPress sites, running within the PHP/WordPress request lifecycle and relying on WordPress's role and capability model. The root cause is classified as CWE-266 (Incorrect Privilege Assignment), where the application assigns a privilege level to an actor that exceeds what is intended - typically because a registration, role-setting, or capability-handling routine is reachable without proper authorization or fails to validate the requesting user's actual rights. Because the affected component is exposed over the network without authentication (per the CVSS vector AV:N/PR:N), the privilege-granting logic can be reached by anonymous requests rather than being gated behind an authenticated administrative context. Exact CPE data was not provided in the input; affected scope is identified from the Patchstack advisory as the Paytium plugin for WordPress.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Privilege escalation reachable by unauthenticated network requests with low complexity (AV:N/AC:L/PR:N/UI:N); gaining elevated WordPress rights yields high confidentiality, integrity, and availability impact.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
DescriptionCVE.org
Unauthenticated Privilege Escalation in Paytium <= 5.0.2 versions.
Executive ViewAI
The Paytium WordPress plugin (versions ≤5.0.2), used for Mollie payment processing and donations, contains an unauthenticated privilege escalation vulnerability (CVSS 9.8) that allows any internet-facing attacker to gain full administrative control of affected websites; no public exploit code has been identified at time of analysis. Organizations using this plugin face immediate risk of complete system compromise, including customer payment data exposure, unauthorized transactions, and website defacement. This vulnerability directly threatens the confidentiality and integrity of payment processing and customer trust.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable and remove the plugin immediately; (2) implement Web Application Firewall rules blocking /wp-content/plugins/paytium/ paths; (3) restrict WordPress administrative access to whitelisted IP ranges; (4) enable comprehensive logging and alerting on admin user creation or privilege escalation attempts; (5) if operational constraints require continued operation, isolate payment-processing servers from broader network and conduct daily exploitation attempt monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB