Privilege Escalation Vulnerability in Pronamic Pay Plugin for WordPress

CVE-2026-16635

What is CVE-2026-16635?

The Pronamic Pay plugin for WordPress suffers from a Privilege Escalation vulnerability that allows authenticated users with Subscriber-level access to potentially escalate their roles to Administrator. This flaw arises from the lack of proper validation when the maybe_update_user_role() function processes a user role value from a Gravity Forms field. Attackers can manipulate the user role field without any checks, resulting in unauthorized role elevation. Exploitation is feasible once a Pronamic Pay payment feed is set up with the Update User Role option enabled, requiring no additional barriers for attackers already authenticated at a basic access level.

References