CVE-2023-7287
📋 TL;DR
This vulnerability allows authenticated WordPress users with subscriber-level permissions to cancel subscriptions managed by the Paytium plugin. It affects WordPress sites using Paytium versions 4.3.7 and earlier. The issue stems from missing authorization checks in the subscription cancellation function.
💻 Affected Systems
- Paytium: Mollie payment forms & donations plugin for WordPress
📦 What is this software?
Paytium by Paytium
⚠️ Risk & Real-World Impact
Worst Case
Attackers could systematically cancel all subscriptions, causing significant revenue loss and disrupting recurring payment services.
Likely Case
Malicious subscribers cancel their own or others' subscriptions, leading to payment processing issues and customer service overhead.
If Mitigated
With proper user role management and monitoring, impact is limited to isolated subscription cancellations that can be quickly restored.
🎯 Exploit Status
Exploitation requires authenticated access but is technically simple once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.3.8
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Paytium plugin and click 'Update Now'. 4. Verify version is 4.3.8 or higher.
🔧 Temporary Workarounds
Temporarily disable subscription functionality
allDisable Paytium subscription features until patched
Restrict subscriber capabilities
allUse WordPress role management to remove plugin-related capabilities from subscriber role
🧯 If You Can't Patch
- Implement strict user role management and audit subscriber accounts
- Monitor subscription cancellation logs and implement alerting for unusual patterns
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins → Paytium version. If version ≤4.3.7, vulnerable.Check Version:
wp plugin list --name=paytium --field=versionVerify Fix Applied:
Verify Paytium version is 4.3.8 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Multiple subscription cancellation requests from subscriber-level users
- Unusual pt_cancel_subscription function calls
Network Indicators:
- POST requests to /wp-admin/admin-ajax.php with action=pt_cancel_subscription
SIEM Query:
source="wordpress.log" AND "pt_cancel_subscription" AND user_role="subscriber"