CVE-2023-7294
📋 TL;DR
The Paytium WordPress plugin versions up to 4.3.7 lack proper capability checks, allowing authenticated users with subscriber-level permissions to create Mollie payment profiles. This vulnerability enables unauthorized payment configuration changes on affected WordPress sites.
💻 Affected Systems
- Paytium: Mollie payment forms & donations plugin for WordPress
📦 What is this software?
Paytium by Paytium
⚠️ Risk & Real-World Impact
Worst Case
Attackers could create fraudulent payment profiles, redirect legitimate payments, or disrupt payment processing entirely, potentially leading to financial loss and reputational damage.
Likely Case
Subscriber-level users create unauthorized payment profiles, causing payment processing issues or enabling payment redirection to attacker-controlled accounts.
If Mitigated
With proper user role management and monitoring, impact is limited to potential configuration changes that can be detected and reverted.
🎯 Exploit Status
Exploitation requires authenticated access but only subscriber-level privileges, which are commonly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.3.8
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Paytium plugin and click 'Update Now'. 4. Verify version is 4.3.8 or higher.
🔧 Temporary Workarounds
Temporary Plugin Deactivation
allDisable the Paytium plugin until patched to prevent exploitation.
wp plugin deactivate paytium
User Role Restriction
linuxTemporarily restrict subscriber-level users from accessing the site.
wp user list --role=subscriber --field=ID | xargs wp user meta add {ID} paytium_access false
🧯 If You Can't Patch
- Implement strict user role management and monitor for unauthorized payment profile creation
- Enable WordPress security plugins with activity logging and alert on payment-related changes
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Paytium version. If version is 4.3.7 or lower, system is vulnerable.Check Version:
wp plugin get paytium --field=versionVerify Fix Applied:
Verify Paytium plugin version is 4.3.8 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- WordPress logs showing subscriber users accessing payment profile creation functions
- Unexpected Mollie API calls from subscriber accounts
Network Indicators:
- Unusual HTTP POST requests to /wp-admin/admin-ajax.php with action=create_mollie_profile
SIEM Query:
source="wordpress" AND (uri_path="/wp-admin/admin-ajax.php" AND http_method="POST" AND form_data.action="create_mollie_profile")