WordPress Pronamic Pay Plugin Unvalidated Role Escalation

The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.1.0 This is due to the `maybe_update_user_role()` function passing an attacker-controlled Gravity Forms field value (`$lead[$feed->user_role_field_id]`) directly into `WP_User::set_role()` without any allowlist validation, capability comparison, or permission check to constrain which roles can be assigned. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their own WordPress account to Administrator by tampering with the role field value in a form submission. Exploitation requires that an administrator has already configured a Pronamic Pay payment feed in Gravity Forms with the **Update User Role** option enabled and mapped to a form field; once that configuration is in place, no further preconditions exist to prevent an authenticated attacker from exploiting this vulnerability.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Pronamic Pay plugin for WordPress contains a critical privilege escalation vulnerability in the `maybe_update_user_role()` function that allows authenticated attackers with Subscriber-level permissions to arbitrarily assign themselves administrative roles. The vulnerability stems from unsanitized user input derived from Gravity Forms field values being passed directly to WordPress's `WP_User::set_role()` method without validation, capability checks, or role allowlisting. This affects all versions up to 10.1.0 and represents a severe risk for any WordPress installation using this plugin, as it enables rapid privilege escalation from low-privilege accounts to full site administrators.

Casky's 224 mapped security skills detect this attack pattern through Claude AI's extended reasoning across multiple vectors aligned with MITRE ATT&CK technique TA0004 (Privilege Escalation). Practitioners using Casky would identify findings related to improper input validation on role assignment functions, unprotected capability checks in user modification workflows, and direct parameter passing to WordPress permission functions. The platform's skill mapping would highlight the absence of role allowlisting mechanisms, missing capability comparisons before `set_role()` calls, and the exploitation chain from authenticated access to administrative privilege. Detection would surface suspicious role modification events triggered by Gravity Forms submissions, particularly when Subscriber-level accounts suddenly gain Editor or Administrator roles through form-based workflows.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-16635.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

penetration testing · medium

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-16635

Casky has 224 skills that investigate the attack patterns behind CVE-2026-16635. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn