WordPress security by component
Knit Pay
Knit Pay (knit-pay) is a WordPress plugin with 3 published CVE records in this archive. The latest tracked vulnerability was published Sep 25, 2026; the highest published CVSS base score is 8.8.
Plugin slug:
knit-payLatest vulnerability
CVE-2026-89426: Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more: Privilege escalation or authentication bypass
Knit Pay (affected: <= 9.6.1.0). A logged-in Subscriber or higher can tamper with the Gravity Forms role field selected by the feed's user_role_field_id. maybe_update_user_role() passes that untrusted value to WP_User::set_role() without a role allowlist. A zero-value order can be marked successful immediately, and the target falls back to the submitter's created_by user ID, allowing administrator escalation without a real payment when the vulnerable integration is configured.
| Safe version |
|
||
|---|---|---|---|
| Sep 25, 2026 |
CVE-2026-89426
Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more: Privilege escalation or authentication bypass
Knit Pay (affected: <= 9.6.1.0). A logged-in Subscriber or higher can tamper with the Gravity Forms role field selected by the feed's user_role_field_id. maybe_update_user_role() passes that untrusted value to WP_User::set_role() without a role allowlist. A zero-value order can be marked successful immediately, and the target falls back to the submitter's created_by user ID, allowing administrator escalation without a real payment when the vulnerable integration is configured.
|
See mitigation notes |
CVE8.8
NVDPending
|
| Jul 23, 2026 |
CVE-2026-57717
Knit Pay: Broken access control
Knit Pay is affected by broken access control. The vulnerable path is reachable without authentication. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a through 9.6.0.0.
|
9.6.0.1 |
CVE6.5
NVDPending
|
| Jun 15, 2026 |
CVE-2026-49070
Knit Pay: Broken access control
Knit Pay is affected by broken access control. The vulnerable path is reachable without authentication. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a through 9.4.0.0.
|
9.4.0.1 |
CVE7.5
NVDPending
|