Knit Pay

An unauthenticated attacker can reach protected functionality without the required authorization. The protected resource and exact operation are not disclosed. The endpoint, action and parameter are not disclosed. The CNA vector records limited confidentiality impact, limited integrity impact. Affected versions: at most 9.6.3.0.

Knit Pay (affected: <= 9.6.1.0). A logged-in Subscriber or higher can tamper with the Gravity Forms role field selected by the feed's user_role_field_id. maybe_update_user_role() passes that untrusted value to WP_User::set_role() without a role allowlist. A zero-value order can be marked successful immediately, and the target falls back to the submitter's created_by user ID, allowing administrator escalation without a real payment when the vulnerable integration is configured.

Knit Pay is affected by broken access control. The vulnerable path is reachable without authentication. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a through 9.6.0.0.

Knit Pay is affected by broken access control. The vulnerable path is reachable without authentication. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a through 9.4.0.0.