CVE-2023-7291
📋 TL;DR
The Paytium WordPress plugin has an authorization vulnerability that allows authenticated users with subscriber-level permissions to create Mollie payment accounts. This affects WordPress sites using Paytium versions 4.3.7 and earlier. Attackers can misuse this to set up unauthorized payment processing accounts.
💻 Affected Systems
- Paytium: Mollie payment forms & donations plugin for WordPress
📦 What is this software?
Paytium by Paytium
⚠️ Risk & Real-World Impact
Worst Case
Attackers create fraudulent payment accounts to process unauthorized transactions, potentially leading to financial loss, reputation damage, and regulatory compliance issues.
Likely Case
Low-privileged users create unauthorized Mollie accounts for testing or minor misuse, potentially disrupting legitimate payment flows.
If Mitigated
With proper user role management and monitoring, impact is limited to minor configuration changes that can be quickly detected and reverted.
🎯 Exploit Status
Exploitation requires authenticated access but only subscriber-level privileges, which are commonly available on WordPress sites.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.3.8
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Paytium plugin and click 'Update Now'. 4. Verify plugin version shows 4.3.8 or higher.
🔧 Temporary Workarounds
Temporary plugin deactivation
allDisable the Paytium plugin until patching is possible
wp plugin deactivate paytium
User role restriction
allTemporarily restrict subscriber-level user access or remove unnecessary subscriber accounts
🧯 If You Can't Patch
- Implement strict user role management and review all subscriber-level accounts
- Enable detailed logging of plugin actions and monitor for unauthorized create_mollie_account function calls
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Installed Plugins → Paytium version. If version is 4.3.7 or lower, system is vulnerable.Check Version:
wp plugin get paytium --field=versionVerify Fix Applied:
After updating, confirm Paytium plugin version shows 4.3.8 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unauthorized calls to create_mollie_account function from subscriber-level users
- Unexpected Mollie account creation events
Network Indicators:
- Unusual API calls to Mollie payment services from WordPress instances
SIEM Query:
source="wordpress" AND (event="plugin_action" AND action="create_mollie_account" AND user_role="subscriber")