WordPress security changelog
HIGH CVE-2026-16635 Received

Pronamic Pay role fields let Subscribers become Administrators

Pronamic Pay through 10.1.0 passes an attacker-controlled Gravity Forms value from the configured user-role field directly to maybe_update_user_role() and WP_User::set_role() without a role allowlist or capability comparison. When a Pronamic Pay feed has Update User Role enabled and mapped to that field, a Subscriber can submit administrator and elevate their own account.

CVE / CNA score 8.8 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Pronamic Pay
Plugin slug
pronamic-ideal
Affected
<= 10.1.0
Safe version
10.2.0
Published
Aug 01, 2026
Weakness
CWE-269 — Improper Privilege Management

This CVE was published Aug 01, 2026 and is one of 1 known issue for this plugin.

What to do

Update, patch or deactivate.

Update Pronamic Pay to 10.2.0 or later. Review affected Gravity Forms feeds and recent account-role changes, remove unauthorized privileges, invalidate sessions, and investigate Administrator activity.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.1.0 This is due to the `maybe_update_user_role()` function passing an attacker-controlled Gravity Forms field value (`$lead[$feed->user_role_field_id]`) directly into `WP_User::set_role()` without any allowlist validation, capability comparison, or permission check to constrain which roles can be assigned. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their own WordPress account to Administrator by tampering with the role field value in a form submission. Exploitation requires that an administrator has already configured a Pronamic Pay payment feed in Gravity Forms with the **Update User Role** option enabled and mapped to a form field; once that configuration is in place, no further preconditions exist to prevent an authenticated attacker from exploiting this vulnerability.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Primary and upstream sources