Pronamic Pay

Pronamic Pay has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of September 2026. Their average CVSS score is 8.8, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is Improper Privilege Management, behind 1 of the records (100%).

The one issue recorded for Pronamic Pay has a vendor fix available, so running the current release closes it.

All of these findings were reported by Afan. Pronamic Pay is installed on roughly 2,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSHigh

8.8/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Pronamic Pay vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2026-16635

Pronamic Pay <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms 'Update user role' Field

Read the full analysis

Vulnerability Records

1 records


2026-07-31 20:28	Pronamic Pay <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms 'Update user role' Field Pronamic Pay <= 10.1.0	`CVE-2026-16635`	8.8 High	Afan	Yes

Showing 1–1 of 1 reports

Latestv10.2.0

Pronamic Pay

Author

Pronamic

4.8(83)

96/100

Last Updated

2026-08-26 (19d ago)

Active Installs

2,000+

Downloads

439,125

Requires WP

6.8+

Requires PHP

8.2+

Tested up to

WP 7.1

Created

2011-08-20 (15y ago)

Pronamic Pay · Pronamic · GitHub Pronamic Pay is the best plugin available to accept payments on your site with support for payment methods like iDEAL | Wero (Netherlands), Bancontact (Belgium), Sofort (Europe) and credit card, among others. Easily add the configuration details of your payment service provider account and enable the payment method in one of the supported e-commerce plugins. With over 200,000 downloads, the plugin has proven itself as a reliable WordPress solution to use for your payments. Key Benefits Supports a wide variety of payment providers. Seamless integration with popular e-commerce and form builder plugins. Automatically updates payment status of orders in WordPress. Easily manage (multiple) payment provider configurations. Continually updated to support the latest e-commerce plugins. Built-in generation of required security certificates. Works with all popular WordPress e-commerce plugins. Recurring payments support for Mollie. Reliable payment solution, with over 200,000 downloads. Supported WordPress e-commerce plugins Charitable Contact Form 7 (requires Premium) Easy Digital Downloads Event Espresso 4 Event Espresso 4 Decaf Formidable Forms Give Gravity Forms MemberPress Ninja Forms Restrict Content Pro WooCommerce Supported payment providers ABN AMRO – iDEAL Zelfbouw – iDEAL 2.0 Adyen (requires Add-On) Buckaroo – HTML EMS – e-Commerce ING – iDEAL Advanced – iDEAL 2.0 Mollie MultiSafepay – Connect Pay.nl Rabobank – Rabo Smart Pay Rabobank – Rabo iDEAL Professional – iDEAL 2.0 Links Pronamic Remco Tolsma

View on WordPress.org