Junglewise Threat Intelligence

CVE-2026-16635: Pronamic Pay privilege escalation in Gravity Forms extension

CVE-2026-16635 · Severity: high · CVSS 8.8 · Published 2026-08-01

Executive brief

The Pronamic Pay plugin for WordPress, which handles payment integrations, contains a security flaw that allows low-level users to upgrade their own accounts to Administrator status. By submitting a specially crafted form, an attacker can gain full control over the website, potentially leading to data theft, site defacement, or complete service disruption. This issue affects sites where the plugin is used in conjunction with Gravity Forms and the 'Update User Role' feature is enabled.

Technical details

The Pronamic Pay plugin for WordPress is vulnerable to privilege escalation in versions up to and including 10.1.0 due to improper input validation in the `maybe_update_user_role()` function. The function passes an attacker-controlled Gravity Forms field value directly into the `WP_User::set_role()` method without verifying the requested role against an allowlist or checking the user's capabilities. An authenticated attacker with Subscriber-level access or higher can exploit this by tampering with form submission data to assign themselves the 'administrator' role. This vulnerability requires that a payment feed is configured with the 'Update User Role' option enabled and mapped to a form field. The issue is addressed in version 10.2.0.

Affected products

  • Pronamic Pronamic Pay <= 10.1.0

Timeline

  • 2026-08-01: disclosed
  • 2026-08-01: advisory

References