WordPress security changelog
HIGH CVE-2026-89426 Deferred

Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more: Privilege escalation or authentication bypass

Knit Pay (affected: <= 9.6.1.0). A logged-in Subscriber or higher can tamper with the Gravity Forms role field selected by the feed's user_role_field_id. maybe_update_user_role() passes that untrusted value to WP_User::set_role() without a role allowlist. A zero-value order can be marked successful immediately, and the target falls back to the submitter's created_by user ID, allowing administrator escalation without a real payment when the vulnerable integration is configured.

CVE / CNA score 8.8 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more
Plugin slug
knit-pay
Affected
<= 9.6.1.0
Safe version
See mitigation notes
Published
Sep 25, 2026
Weakness
CWE-269 — Improper Privilege Management

This CVE was published Sep 25, 2026 and is one of 4 known issues for this plugin.

What to do

Update, patch or deactivate.

This archive could not verify a fixed version from the official author release notes reviewed on 2026-10-13. Disable the affected feature or component where practical until remediation for the deployed configuration is established. Disable the affected Gravity Forms role-assignment integration until confirmed fixed. Derive roles from trusted feed configuration, permit only explicitly allowed roles, bind the target user and verify payment state server-side; review recently elevated accounts. Official author release notes: https://wordpress.org/plugins/knit-pay/.

No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.6.1.0. This is due to the `maybe_update_user_role()` function reading the target role directly from an attacker-controlled Gravity Forms entry field — configured via the feed's `user_role_field_id` — and passing it to `WP_User::set_role()` without validating the supplied value against an allowlist of permitted roles. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to administrator by tampering with the hidden role field value at form submission time. Exploitation is further enabled by the fact that $0 orders are synchronously marked as SUCCESS during form submission without requiring a real payment, and when no GF User Registration user can be resolved, the role assignment target falls back to `$lead['created_by']` — the currently authenticated submitter's own user ID — making any authenticated form submitter an eligible exploitation target.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Primary and upstream sources