Description
The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.1.0 This is due to the `maybe_update_user_role()` function passing an attacker-controlled Gravity Forms field value (`$lead[$feed->user_role_field_id]`) directly into `WP_User::set_role()` without any allowlist validation, capability comparison, or permission check to constrain which roles can be assigned. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their own WordPress account to Administrator by tampering with the role field value in a form submission. Exploitation requires that an administrator has already configured a Pronamic Pay payment feed in Gravity Forms with the **Update User Role** option enabled and mapped to a form field; once that configuration is in place, no further preconditions exist to prevent an authenticated attacker from exploiting this vulnerability.
Published: 2026-08-01
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability in Pronamic Pay up to version 10.1.0 allows an authenticated user with Subscriber-level access or higher to elevate their privileges to Administrator by manipulating a Gravity Forms field that is passed directly to WP_User::set_role. The affected code has no allowlist or permission checks when updating the user role, enabling attackers to assign themselves any role. This flaw can compromise confidentiality, integrity, and availability by granting full administrative control.

Affected Systems

WordPress sites running the Pronamic Pay plugin version 10.1.0 or earlier with a Gravity Forms payment feed configured to "Update User Role". All installations of pronamic:Pronamic Pay that have this capability enabled are impacted.

Risk and Exploitability

The CVSS score is 8.8, indicating a high severity. EPSS suggests the likelihood of exploitation is very low (<1%), and the vulnerability is not yet listed in the CISA KEV catalog, but the presence of the flaw in a widely used plugin means it could be targeted as a low‑probability, high‑impact attack. The attack vector requires at least an authenticated account with Subscriber or higher privileges, after an administrator has configured the plugin to expose the Update User Role option.

Generated by OpenCVE AI on August 2, 2026 at 03:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest version of the Pronamic Pay plugin (10.2.0 or newer) to remove the vulnerable code.
  • Review all Gravity Forms payment feed configurations and disable the "Update User Role" option or ensure it is mapped only to roles that the authenticated user is allowed to assume.
  • If immediate update is not possible, restrict or remove the role field in any form that triggers the update mechanism, and enforce role‑based access control to the WP_User::set_role function to prevent unauthorized role assignment.

Generated by OpenCVE AI on August 2, 2026 at 03:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 03 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sun, 02 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Pronamic
Pronamic pronamic Pay
Wordpress
Wordpress wordpress
Vendors & Products Pronamic
Pronamic pronamic Pay
Wordpress
Wordpress wordpress

Sat, 01 Aug 2026 09:15:00 +0000

Type Values Removed Values Added
Description The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.1.0 This is due to the `maybe_update_user_role()` function passing an attacker-controlled Gravity Forms field value (`$lead[$feed->user_role_field_id]`) directly into `WP_User::set_role()` without any allowlist validation, capability comparison, or permission check to constrain which roles can be assigned. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their own WordPress account to Administrator by tampering with the role field value in a form submission. Exploitation requires that an administrator has already configured a Pronamic Pay payment feed in Gravity Forms with the **Update User Role** option enabled and mapped to a form field; once that configuration is in place, no further preconditions exist to prevent an authenticated attacker from exploiting this vulnerability.
Title Pronamic Pay <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms 'Update user role' Field
Weaknesses CWE-269
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Pronamic Pronamic Pay
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-08-03T15:38:33.517Z

Reserved: 2026-07-22T16:41:01.494Z

Link: CVE-2026-16635

cve-icon Vulnrichment

Updated: 2026-08-03T13:44:18.199Z

cve-icon NVD

Status : Deferred

Published: 2026-08-01T09:17:00.970

Modified: 2026-08-12T21:00:37.147

Link: CVE-2026-16635

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T20:31:43Z

Weaknesses
  • CWE-269

    Improper Privilege Management