Skip to content
Noroxi

Paytium: Mollie payment forms & donations

paytium · plugin

Known security vulnerabilities for Paytium: Mollie payment forms & donations. Find out in seconds which version runs on your site with WP Lens.

13 known vulnerabilities

2 critical · 3 exploitable without logging in · latest Sep 23, 2026

Listed on wordpress.org · latest 5.0.5 · last updated Sep 7, 2026 · 2K+ installs

wordpress.org status checked on Oct 5, 2026

Vulnerabilities

  • CVE-2026-18467unauthenticated≤ 5.0.3

    Paytium: Mollie payment forms & donations <= 5.0.3 - Unauthenticated Privilege Escalation via 'pt_form_field[pt-user-role]' Parameter

    Critical 9.8

  • CVE-2026-56030unauthenticated≤ 5.0.2

    WordPress Paytium plugin <= 5.0.2 - Privilege Escalation vulnerability

    Critical 9.8

  • CVE-2023-7291subscriber+≤ 4.3.7

    Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'create_mollie_account'

    High 8.1

  • CVE-2023-7294subscriber+≤ 4.3.7

    Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'create_mollie_profile'

    Medium 6.5

  • CVE-2023-7287subscriber+≤ 4.3.7

    Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'pt_cancel_subscription'

    Medium 5.4

  • CVE-2024-25099login required≤ 4.4.2

    WordPress Paytium: Mollie payment forms & donations Plugin <= 4.4.2 is vulnerable to Cross Site Scripting (XSS)

    Medium 5.4

  • CVE-2025-24552unauthenticated≤ 4.4.11

    WordPress Paytium plugin <= 4.4.11 - Full Path Disclosure (FPD) vulnerability

    Medium 5.3

  • CVE-2024-51667login required≤ 4.4.10

    WordPress paytium plugin <= 4.4.10 - Broken Access Control vulnerability

    Medium 4.3

  • CVE-2023-7293subscriber+≤ 4.3.7

    Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'check_mollie_account_details'

    Medium 4.3

  • CVE-2023-7292subscriber+≤ 4.3.7

    Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'paytium_notice_dismiss'

    Medium 4.3

  • CVE-2023-7290subscriber+≤ 4.3.7

    Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'check_for_verified_profiles'

    Medium 4.3

  • CVE-2023-7289subscriber+≤ 4.3.7

    Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'paytium_sw_save_api_keys'

    Medium 4.3

  • CVE-2023-7288subscriber+≤ 4.3.7

    Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'update_profile_preference'

    Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory