CVE-2026-56030: WordPress Paytium plugin <= 5.0.2 - Privilege Escalation vulnerability

Synopsis

This is an unauthenticated privilege escalation vulnerability in the Paytium WordPress plugin, versions 5.0.2 and earlier. The flaw is reachable over the network and requires no authentication or user interaction, meaning any remote attacker who can reach the WordPress installation can exploit it. Successful exploitation allows the attacker to escalate their privileges within the WordPress site, leading to full confidentiality, integrity, and availability impact. No fix version has been published yet; HarborGuard tracks the upstream advisory and will make a patched rebuild available as soon as a fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the WordPress installation over the network; the vulnerable plugin endpoint is exposed to any client that can send HTTP requests to the server.

• AuthenticationNot required

  No account or credentials of any kind are needed; the privilege escalation is fully unauthenticated.

• Victim interactionNot required

  No victim action is required; the attacker triggers the vulnerability entirely on their own without involving any logged-in user.

• Attack complexityDetail

  Exploit complexity is low, meaning the attack is reliable and requires no special environmental conditions, race conditions, or target-specific setup.

Blast Radius

• A successful attacker gains elevated privileges within the WordPress application, up to and including administrator-level access, without supplying any credentials.
• With elevated access, the attacker can read all site content, stored user data, and any secrets or API keys held in the WordPress database or filesystem.
• The attacker can modify or delete posts, pages, users, plugin settings, and any other persisted site data.
• The attacker can install malicious plugins or themes, effectively taking full control of the WordPress instance and any underlying infrastructure it has access to.