CVE-2026-16635 pronamic CVE debrief

Who should care

Administrators of WordPress sites using the Pronamic Pay plugin, especially those with Gravity Forms integrated, should be aware of this vulnerability and take immediate action to prevent exploitation. They should review and restrict user role assignments in Gravity Forms, monitor for suspicious activity, and implement additional security measures to prevent exploitation. Site owners and security teams should prioritize updating the Pronamic Pay plugin and review their current configurations to ensure they are not exposed to this vulnerability. Additionally, they should verify that their site's user roles and permissions are properly configured to prevent unauthorized privilege escalation. Security teams should also consider implementing compensating controls, such as monitoring and incident response plans, to detect and respond to potential exploitation attempts. WordPress administrators should also ensure that all users with Subscriber-level access and above are aware of this vulnerability and are taking necessary precautions to prevent exploitation. Furthermore, site administrators should review their Gravity Forms configurations to ensure that the Update User Role option is not enabled and mapped to a form field, or restrict access to this feature to trusted users only. By taking these steps, administrators can help prevent exploitation of this vulnerability and protect their WordPress sites from potential attacks. Security teams should also consider conducting a thorough review of their site's security posture to identify potential vulnerabilities and implement measures to prevent exploitation. This may include reviewing user roles and permissions, monitoring for suspicious activity, and implementing additional security measures such as firewalls and intrusion detection systems. By prioritizing security and taking proactive steps to prevent exploitation, administrators can help protect their WordPress sites from potential attacks and maintain the security and integrity of their site's data. Site owners should also consider implementing a web application firewall (WAF) to detect and prevent exploitation attempts. They should also ensure that all users are up

Technical summary

The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation due to the `maybe_update_user_role()` function passing an attacker-controlled Gravity Forms field value directly into `WP_User::set_role()` without any allowlist validation, capability comparison, or permission check. This vulnerability allows authenticated attackers with Subscriber-level access and above to escalate their own WordPress account to Administrator by tampering with the role field value in a form submission. The vulnerability exists in all versions up to, and including, 10.1.0.

Defensive priority

High priority due to the high CVSS score of 8.8 and the potential for privilege escalation.

Recommended defensive actions

• Update the Pronamic Pay plugin to a version that fixes the vulnerability
• Review and restrict user role assignments in Gravity Forms
• Monitor for suspicious activity and implement additional security measures to prevent exploitation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability exists in the Pronamic Pay plugin for WordPress, specifically in the `maybe_update_user_role()` function. The function does not perform proper validation or checks before assigning roles, allowing attackers to escalate their privileges.

Official resources