CVE-2026-18467

Executive Summary

CVE-2026-18467 is a critical unauthenticated privilege escalation vulnerability in the Paytium: Mollie payment forms & donations WordPress plugin, affecting all versions up to and including 5.0.3. A broken/incomplete patch introduced in 5.0.3 added a signature gate on one input path but left a second, unsigned filter (pt_cf_checkout_meta()) that permits attacker-controlled role data to reach wp_insert_user(). Successful exploitation allows an unauthenticated remote attacker to create a new WordPress administrator account and fully take over the affected site (CVSS 9.8, CWE-269).

Technical Analysis

The vulnerability is rooted in a privilege escalation via unsigned input overwriting a signature-verified data path, and belongs to the CWE-269 (Improper Privilege Management) class. The plugin implements a user-registration / donation form flow exposed through the public [paytium] shortcode, which is rendered on front-facing pages and therefore reachable without authentication.

Two distinct processing paths exist in the plugin:

1. Signed path (patched in 5.0.3): The pt-paytium-user-data field is protected by a wp_hash() / hash_equals() signature gate. This was the patch delivered in 5.0.3.
2. Unsigned path (left vulnerable): A second filter, pt_cf_checkout_meta(), is registered on the pt_meta_values hook after the signed builder. It copies every $_POST['pt_form_field'][*] key verbatim into the payment meta array without any signature verification.

Because the unsigned filter runs after the signed builder, an attacker-supplied pt-user-role value propagated through pt_form_field[] overwrites the output of the signed path. The value is then persisted as the _pt-user-role post meta. Later, paytium_user_data_processing() reads this persisted _pt-user-role post meta and passes it directly as the role argument to wp_insert_user() without validation, allow-listing, or capability checks. Since wp_insert_user() accepts a raw role string, supplying administrator results in creation of an administrator-capable account.

Root cause: output of a security-critical, signature-protected data path is overridden by a parallel, unsigned data path that shares the same destination meta key (_pt-user-role). The signature gate is therefore trivially bypassed by writing to the meta array via the second filter.

Attack surface: Any publicly reachable page containing the [paytium] shortcode that permits form submission and payment completion. No authentication or special privileges are required (PR:N), no user interaction beyond completing the attacker's own payment flow (UI:N), and the attack is network-reachable (AV:N). Insufficient detail in the source data precludes describing further internal hook ordering or nonce behavior beyond what is stated above.

Exploitation Scenarios

No public PoC or Nuclei template is available. The chain below is derived strictly from the NVD description and should be treated as a vulnerability-class/mechanism reconstruction, not a verbatim exploit.

1. Reconnaissance / target identification: The attacker identifies WordPress sites running the Paytium plugin (e.g., via Shodan/HTTP fingerprinting for wp-content/plugins/paytium or pages containing the [paytium] shortcode) and locates a publicly exposed payment/donation form.
2. Triggering the flaw class: The attacker submits a payment through the [paytium] form and, using the pt_form_field[] input array, supplies a pt-user-role value of administrator. This value is copied verbatim by pt_cf_checkout_meta() (the unsigned pt_meta_values filter), overwriting the signature-protected pt-paytium-user-data path that was hardened in 5.0.3.
3. Execution at the vulnerability-class level: The attacker completes the resulting payment flow. On completion, paytium_user_data_processing() reads the attacker-controlled _pt-user-role post meta and passes it directly as the role argument to wp_insert_user(), creating a new WordPress account with the administrator role and the attacker's supplied email address.
4. Post-exploitation impact: The attacker seizes the newly created administrator account via the standard lost-password flow using the supplied email, then has full administrative control of the WordPress site — content manipulation, plugin/theme installation, webshell deployment, data exfiltration, and lateral movement toward any co-hosted services.

Preconditions: A completed payment via the form is required, so a valid (attacker-controlled) payment method and any live payment configuration must be present. No public exploit code is circulating; detection must therefore rely on behavioral logic rather than signatures.

Impact Assessment

This is a maximum-severity (CVSS 9.8) issue with full confidentiality, integrity, and availability impact (C:H/I:H/A:H) and a scope-unchanged rating. Because exploitation yields a full administrator account on a WordPress installation, the blast radius extends beyond the plugin:

• Business impact: Complete site takeover — defacement, SEO poisoning, malware/redirect injection, payment skimming on the Mollie-integrated donation pages, and abuse of the site for phishing or as a pivot into the host.
• Affected systems: Any WordPress installation running Paytium ≤ 5.0.3 with a publicly reachable [paytium] form. Nonprofits, charities, and small businesses relying on Mollie donations are the primary exposure profile.
• Privileges required: None (PR:N). User interaction: None (UI:N). Attack complexity: Low (AC:L) — the mechanism is deterministic given a completed payment.
• Chained risk: An attacker with admin access can install arbitrary plugins/themes, creating a persistent foothold and enabling supply-chain-style payload delivery to site visitors.

Detection Guidance

Sigma Rule

title: Paytium Privilege Escalation via pt_form_field pt-user-role
id: 3f7c9a21-8b4e-4c2a-9d6f-paytium18467
status: experimental
description: Detects submission of the pt-user-role key inside pt_form_field, indicating exploitation of CVE-2026-18467 in Paytium <= 5.0.3.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-18467
author: valtersit.com
logsource:
  category: webserver
detection:
  selection_method:
    http.method: 'POST'
  selection_field:
    cs-uri-query|contains:
      - 'pt_form_field'
      - 'pt-user-role'
  selection_uri:
    cs-uri|contains: 'paytium'
  condition: selection_method and (selection_field or (selection_uri and selection_field))
falsepositives:
  - Legitimate form submissions that coincidentally reference the role key (expected: none for non-admin roles).
level: critical

YARA Rule

rule CVE_2026_18467_Paytium_PrivEsc
{
    meta:
        description = "Detects Paytium plugin source referencing the unsigned pt_cf_checkout_meta filter and pt-user-role handling (CVE-2026-18467)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-18467"
        date = "2026-01-01"
    strings:
        $f1 = "pt_cf_checkout_meta" ascii
        $f2 = "pt_meta_values" ascii
        $f3 = "pt-user-role" ascii
        $f4 = "pt_form_field" ascii
        $f5 = "paytium_user_data_processing" ascii
        $f6 = "pt-paytium-user-data" ascii
    condition:
        uint32(0) != 0x504B0304 and
        filesize < 5MB and
        (($f1 and $f3) or ($f2 and $f3) or ($f5 and $f3) or ($f4 and $f6))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-18467 Paytium pt-user-role privilege escalation attempt"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"pt_form_field"; content:"pt-user-role"; distance:0; content:"administrator"; nocase; classtype:attempted-admin; reference:cve,2026-18467; sid:90018467; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10m
  [http where http.request.method == "POST" and
       url.path : "*paytium*" and
       http.request.body.content : "*pt_form_field*"]
  [http where http.request.method == "POST" and
       http.request.body.content : "*pt-user-role*" and
       http.request.body.content : "*administrator*"]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx
| eval body = coalesce(form_data, request_body, "")
| where (cidr_match("0.0.0.0/0", src) OR true)
| search (uri_path="*paytium*" OR body="*pt_form_field*")
| search body="*pt-user-role*"
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths by src, host
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,paytium,">
  <rule id="100467" level="14">
    <decoded_as>web-accesslog</decoded_as>
    <if_sid>31100</if_sid>
    <field name="url">paytium</field>
    <description>CVE-2026-18467: Possible Paytium privilege escalation - payment form interaction on [paytium] shortcode page</description>
  </rule>
  <rule id="100468" level="15">
    <decoded_as>web-accesslog</decoded_as>
    <if_sid>31100</if_sid>
    <match>pt-user-role</match>
    <description>CVE-2026-18467: Paytium pt-user-role submission detected - likely administrator privilege escalation attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — a single source, NVD, claims a patch; not independently confirmed).

1. Immediate mitigations (independently of patch verification):

   • Disable or remove the Paytium plugin until a verified fix is available; the vulnerability is unauthenticated and remotely triggerable.
   • If the plugin must remain active, restrict front-end access to any page rendering the [paytium] shortcode (WAF/IP allow-listing, authentication enforcement), or set the forms behind a maintenance/private mode.
   • Add a WAF rule to block or alert on POST requests containing pt-user-role or unexpected pt_form_field[*] role values.
   • Monitor for new administrator account creation and unexpected password-reset activity, and review _pt-user-role post meta for anomalous values.

2. Patch/upgrade steps:

   • A patch is claimed in version 5.0.3, but the NVD description states the 5.0.3 change is incomplete — the pt_cf_checkout_meta() path remains unsigned. Do not rely on 5.0.3 alone.
   • Monitor the vendor (Paytium / Mollie plugin maintainer) for a follow-up release that validates/allow-lists the role value and closes the unsigned pt_meta_values filter path.
   • Treat the vendor fix status as N/A / unconfirmed until an advisory explicitly states the second filter is hardened.

3. Long-term hardening:

   • Enforce role allow-listing at the application layer — never pass user-supplied strings directly to wp_insert_user()'s role argument.
   • Apply signature/nonce verification to all parallel input paths, not just one; audit hooks for filters that execute after hardened builders and can overwrite their output.
   • Apply the WordPress least-privilege principle: limit who can register accounts and require email verification with rate limiting.
   • Maintain a plugin inventory and subscribe to WPScan/NVD feeds for Paytium updates; periodically test donation/payment forms for unsigned parameter injection.

References

• NVD — CVE-2026-18467: https://nvd.nist.gov/vuln/detail/CVE-2026-18467
• MITRE CWE-269 — Improper Privilege Management: https://cwe.mitre.org/data/definitions/269.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• WordPress Plugin Handbook — wp_insert_user() and role handling: https://developer.wordpress.org/reference/functions/wp_insert_user/
• CISA KEV catalog (not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / in-the-wild evidence: None reported. No public PoC, no Nuclei template, no exploit code, and no CISA KEV entry. No known campaigns are associated with CVE-2026-18467 at this time.