Threats Tagged 'cve-2026-16635'

Pronamic Pay plugin for WordPress versions up to and including 10.1.0 contains a privilege escalation vulnerability. The vulnerability arises from the function maybe_update_user_role() which uses an attacker-controlled Gravity Forms field value directly in WP_User::set_role() without validation or permission checks. This allows authenticated users with Subscriber-level access or higher to escalate their privileges to Administrator if an administrator has configured a payment feed with the Update User Role option enabled and mapped to a form field. No further conditions are required for exploitation once this configuration is in place.