CVE-2026-114196

CriticalCVSS 9.8

Published: 24/10/2026(UTC)Translated: 24/10/2026(UTC)NVD NIST

Summary

The WordPress plugin Paytium up to version 5.0.5 is vulnerable to deserialization of untrusted data, allowing object injection. This may enable an attacker to perform unauthorized actions.

Risk Assessment

The vulnerability could be exploited to inject malicious objects, potentially leading to site compromise or arbitrary code execution. The risk is high, especially if the plugin handles payments.

Recommendation

Update the Paytium plugin to a version newer than 5.0.5 that includes the fix. In the meantime, consider restricting access to the plugin's features or disabling it.

Other vulnerabilities in Paytium

CVE-2026-18467Critical
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.3. The 5.0.3 patch added a signature gate on the pt-paytium-user-data field but left a second filter, pt_cf_checkout_meta(), that copies $_POST['pt_form_field'] values without signature verification, allowing the user role to be overwritten and an administrator account to be created.

Original NVD description (English source)

Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS