CVE Intelligence
Analysis AI-assisted

CVE-2026-56030: Paytium WordPress Plugin Unauthenticated Privilege Escalation

CVE-2026-56030 is recorded as an unauthenticated privilege escalation issue (CWE-266) in Paytium versions up to and including 5.0.2. The CNA score is CVSS 3.1 9.8 (Critical), and the record lists no fixed version. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes an unauthenticated privilege escalation issue in Paytium versions up to and including 5.0.2. It is classified as CWE-266 (Incorrect Assignment of Privileges). The cited reference is filed under WordPress plugins on the Patchstack database.

Impact

  • The CNA-provided CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required and no user interaction.
  • The vector rates confidentiality, integrity and availability impact as high, which yields a base score of 9.8 (Critical).
  • Privilege escalation without authentication would allow an unauthenticated party to gain rights normally reserved for higher-privileged accounts. The record does not detail the exact actions an attacker could take.

Affected products and versions

  • Product: Paytium (WordPress plugin, per the reference URL path).
  • Affected range stated in the description: versions up to and including 5.0.2.
  • The structured affected-products list in the record is empty, so the exact vendor and product metadata should be confirmed against the Patchstack entry.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record.
  • No confirmed exploitation appears in the sources consulted.
  • The EPSS probability is 0.00483 (percentile 0.39868) as of 2026-10-13, which is a statistical estimate and not evidence of exploitation.

Remediation and mitigation

  • No fixed version is listed in the record. The absence of a listed fix does not mean none exists; check the Patchstack entry and the plugin's official channels for updates.
  • Until a fix is confirmed, consider inventorying installations of the Paytium plugin and reviewing whether versions up to 5.0.2 are in use.
  • Where feasible, restrict administrative and account-related functions, review user roles and recently created or modified accounts, and monitor for unexpected privilege changes.

Detection guidance

  • Review WordPress user accounts for unexpected role or capability changes, especially accounts that gained administrator-level rights.
  • Check web server and application logs for unusual requests to the plugin's endpoints and for unexpected administrative actions.
  • Compare plugin file integrity against known-good copies where such baselines exist.

Limitations of the available information

  • No fixed version, patch details or vendor advisory text is included in the record.
  • The CWE name is not provided in the record, only the identifier.
  • The CVE description is brief and does not describe the technical mechanism, required conditions or observed impact.
  • The CVSS score comes from the CNA; no NVD-assigned score is shown in the record.

Frequently asked questions

What is CVE-2026-56030?

It is a recorded unauthenticated privilege escalation issue in Paytium versions up to and including 5.0.2, classified as CWE-266 with a CNA-assigned CVSS 3.1 base score of 9.8.

Is there a fixed version available?

The record does not list a fixed version. Check the Patchstack entry and official plugin channels for updates.

Is this vulnerability being actively exploited?

It is not listed in the CISA KEV catalog in this record, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.