CVE-2026-18467 is a privilege escalation vulnerability in the Paytium: Mollie payment forms & donations WordPress plugin affecting all versions up to and including 5.0.3. Although version 5.0.3 introduced a signature check on the pt-paytium-user-data field, a second filter (pt_cf_checkout_meta) registered later copies POSTed form fields into payment meta without signature verification. This allows an attacker to overwrite the pt-user-role meta value, which is then used as the role argument in wp_insert_user(), enabling creation of a new administrator account by an unauthenticated attacker. Exploitation requires submitting a payment through a publicly accessible paytium shortcode form and completing the payment process, after which the attacker can take over the new admin account via the lost-password flow.

Successful exploitation allows unauthenticated attackers to create new WordPress accounts with administrator privileges, resulting in full site takeover. This compromises confidentiality, integrity, and availability of the affected WordPress site.

A patch is available in version 5.0.3 that partially addresses the issue by adding a signature gate on the pt-paytium-user-data field. However, the vulnerability persists in version 5.0.3 due to a second filter lacking signature verification. Users should upgrade to a version later than 5.0.3 once available that fully addresses this issue. Until then, restrict access to publicly exposed paytium shortcode forms or disable the plugin to prevent exploitation. Monitor vendor advisories for official fixes.