CVE-2026-89426 Details
Description
The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.6.1.0. This is due to the `maybe_update_user_role()` function reading the target role directly from an attacker-controlled Gravity Forms entry field — configured via the feed's `user_role_field_id` — and passing it to `WP_User::set_role()` without validating the supplied value against an allowlist of permitted roles. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to administrator by tampering with the hidden role field value at form submission time. Exploitation is further enabled by the fact that $0 orders are synchronously marked as SUCCESS during form submission without requiring a real payment, and when no GF User Registration user can be resolved, the role assignment target falls back to `$lead['created_by']` — the currently authenticated submitter's own user ID — making any authenticated form submitter an eligible exploitation target.
A privilege escalation vulnerability has been identified in the Knit Pay WordPress plugin, specifically in versions through 9.6.1.0. The issue arises from the 'maybe_update_user_role()' function, which improperly handles user role assignments. The function reads role information from a Gravity Forms entry field that can be manipulated by attackers. This unchecked input is then passed to 'WP_User::set_role()' without proper validation against an allowlist of permitted roles. As a result, authenticated attackers with Subscriber-level access or higher can modify the role field value during form submission to gain administrator privileges. The vulnerability is exacerbated by the fact that $0 orders are automatically marked as successful without requiring actual payment. Additionally, if no user is associated with the Gravity Forms entry, the role assignment defaults to the entry creator's user ID, making any authenticated user a potential target for exploitation.
Users are advised to update the Knit Pay WordPress plugin to version 9.6.2.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 25, 2026CISA-ADP
Assessed Sep 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Knit Pay | <= 9.6.1.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 25, 2026 | CVE Modified | CISA-ADP |
| Sep 25, 2026 | New CVE Received | [email protected] |