A critical privilege escalation vulnerability in the Paytium WordPress plugin allows unauthenticated attackers to gain administrative control over affected websites.

The plugin fails to perform signature verification on specific form fields processed during the payment flow, allowing an unauthenticated attacker to inject a malicious user role that is subsequently passed to the wp_insert_user function.

This vulnerability carries a CVSS score of 9.8, indicating a critical risk of complete system compromise. Successful exploitation results in unauthorized administrative access, which can lead to total data loss, the deployment of malicious payloads, and significant reputational damage to the organization.

Immediate Action: Since a specific patch version is not currently identified, users should immediately deactivate and remove the Paytium plugin until a secure update is released by the vendor.

Proactive Monitoring: Security teams should monitor site access logs for suspicious administrative account creation events and review user registration logs for anomalies originating from the payment shortcode flow.

Compensating Controls: Implement a Web Application Firewall (WAF) to block suspicious POST requests targeting the pt-paytium-user-data or pt_meta_values hooks, though this should be considered a temporary measure only.

Public Exploit Available: Unknown.

Given the critical nature of this privilege escalation flaw, immediate action is required to prevent unauthorized site takeover. Organizations currently utilizing this plugin must prioritize its removal or restriction until the vendor provides a verified security update that correctly implements signature validation for all user-supplied metadata fields.