CVE-2026-16635 is a privilege escalation vulnerability in the Pronamic Pay WordPress plugin (<=10.1.0). The vulnerability is due to the maybe_update_user_role() function passing a user-controllable Gravity Forms field value directly into WP_User::set_role() without any allowlist validation, capability comparison, or permission checks. Authenticated attackers with Subscriber-level access or above can exploit this to escalate their account privileges to Administrator by tampering with the role field value in a form submission. Exploitation requires that an administrator has configured a Pronamic Pay payment feed in Gravity Forms with the Update User Role option enabled and mapped to a form field. No other preconditions exist to prevent exploitation.

Successful exploitation allows an authenticated user with Subscriber-level access or higher to escalate their privileges to Administrator, gaining full control over the WordPress site. This can lead to complete compromise of the site, including content modification, user management, and potential further attacks. The vulnerability has a CVSS 3.1 score of 8.8 (high severity), reflecting its network attack vector, low attack complexity, required privileges of low (authenticated user), no user interaction, and impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should disable the Update User Role option in Pronamic Pay payment feeds configured in Gravity Forms or avoid mapping user role fields to form inputs. Restrict access to Gravity Forms and Pronamic Pay configuration to trusted administrators only. Monitor for suspicious privilege changes. Follow official vendor advisories for updates and apply patches promptly once released.