CVE-2023-7291 is a missing authorization flaw in the Paytium: Mollie payment forms and donations plugin for WordPress, versions up to and including 4.3.7. Any logged in user, even a subscriber, could set up a Mollie account through the plugin. It scores 7.1 (High). Update past 4.3.7.
What's affected
Affected: Paytium versions up to and including 4.3.7. The vulnerable code is the create_mollie_account function.
Fixed: the record does not name a fixed version. It links a code changeset in the plugin repository, and the description says versions up to 4.3.7 are affected, which implies a release after 4.3.7. I could not load the Wordfence page, so check the plugin changelog for the version that adds the capability check.
The weakness is CWE-862, missing authorization. The vector is network reachable with low privileges (a subscriber account), no user interaction, high integrity impact and low availability impact. KEV is false.
How to check if you're exposed
List the plugin version on each site.
wp plugin list --name=paytium --fields=name,status,version
If the version is 4.3.7 or lower, you are affected. Also check whether your site allows open registration. If anyone can register a subscriber account, the privilege bar for this bug is effectively gone.
What to do now
- Update Paytium to the newest version, and confirm in the changelog that the Mollie account setup now checks capabilities.
- Check the Mollie account settings in the plugin for values you did not set, and review where payments are being sent.
- Review the user list for subscriber accounts you do not recognise, and turn off open registration if you do not need it.
- Rotate Mollie API keys if you cannot rule out misconfiguration.
- Tell finance or the site owner to watch for unexpected payout details.
Why it matters
Missing authorization means the code runs an action without asking whether the user is allowed to do it. WordPress offers capability checks for this purpose, and a function that changes payment settings should require an administrator capability. Here the check was absent.
The issue is more serious on payment plugins than on most plugins. Changing which account receives money is a business risk, not just a site risk. The impact is rated high on integrity because the data being modified controls where funds go.
Site owners should treat subscriber accounts as untrusted. If a plugin forgets one check, those accounts reach the function.
Quick check
Does the attacker need an administrator account?
No. A subscriber level account is enough, per the record.
Which version fixes CVE-2023-7291?
The record does not name one. Use a version newer than 4.3.7 and read its changelog.
Sources
Last reviewed: 19 October 2026.
