Pronamic Pay EUVD-2026-51795

Requires an authenticated WordPress account at Subscriber privilege level or above - unauthenticated exploitation is not possible given PR:L in the CVSS vector. The critical enabling condition is that a site administrator must have previously configured at least one Pronamic Pay payment feed within Gravity Forms with the 'Update User Role' option explicitly enabled AND mapped to a form field that is visible and submittable by non-admin users. This is a non-default, intentional configuration choice. Without this specific Gravity Forms feed configuration, the vulnerable code path (maybe_update_user_role()) is never triggered and the site is not exploitable regardless of plugin version. Exploitation is limited to WordPress installations running the Pronamic Pay plugin with an active Gravity Forms license and the described feed configuration in place.

The vendor-assigned CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is broadly accurate: the attack is network-delivered via a standard form POST, requires only subscriber-level authentication, no user interaction, and yields full C/I/A impact through admin account takeover. The primary risk-reducing factor not fully captured by CVSS is the non-default deployment precondition: the 'Update User Role' Gravity Forms feed option must be enabled and mapped to a user-controlled field by an administrator. Sites that have never configured this feature are not exploitable. This distinguishes real-world exposure from the theoretical maximum implied by CVSS. No EPSS score or KEV listing was provided, meaning exploitation probability from probabilistic models is unknown and no confirmed in-the-wild abuse has been reported. The patch in 10.2.0 is confirmed by the SVN changeset reference. Overall priority should be HIGH for any site using the Pronamic Pay Gravity Forms integration with the Update User Role feed option enabled, and LOW-to-MEDIUM for all others pending configuration audit.

An attacker registers or holds a Subscriber-level account on a WordPress site that has a Pronamic Pay payment feed configured in Gravity Forms with the Update User Role option enabled and mapped to a form field. The attacker submits the payment form with the role field value set to 'administrator' - either by intercepting the request via a proxy or constructing a direct POST - causing maybe_update_user_role() to call WP_User::set_role('administrator') on their own account. The attacker's account is immediately promoted to Administrator, granting full control over the WordPress installation including the ability to install backdoors, exfiltrate data, or pivot to the underlying hosting environment. No public proof-of-concept code has been confirmed, but the exploit logic is trivially derivable from the disclosed source code references.