CVE-2026-89426
Received Received - Intake

Privilege Escalation in Knit Pay WordPress Plugin

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: Wordfence

Description
The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.6.1.0. This is due to the `maybe_update_user_role()` function reading the target role directly from an attacker-controlled Gravity Forms entry field — configured via the feed's `user_role_field_id` — and passing it to `WP_User::set_role()` without validating the supplied value against an allowlist of permitted roles. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to administrator by tampering with the hidden role field value at form submission time. Exploitation is further enabled by the fact that $0 orders are synchronously marked as SUCCESS during form submission without requiring a real payment, and when no GF User Registration user can be resolved, the role assignment target falls back to `$lead['created_by']` — the currently authenticated submitter's own user ID — making any authenticated form submitter an eligible exploitation target.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-89426
EUVD
EUVD-2026-86579

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
knit_pay knit_pay to 9.6.1.0 (inc)
knit_pay cashfree 9.6.1.0
knit_pay instamojo 9.6.1.0
knit_pay razorpay 9.6.1.0
knit_pay paypal 9.6.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This WordPress plugin vulnerability allows authenticated attackers with Subscriber-level access or higher to escalate their privileges to administrator. The flaw exists in the maybe_update_user_role() function, which reads a role value directly from an attacker-controlled Gravity Forms entry field without proper validation. Attackers can manipulate this field to set their own role to administrator during form submission.

Detection Guidance

Check if the Knit Pay plugin version is 9.6.1.0 or lower. Look for unauthorized privilege changes in WordPress user roles. Review Gravity Forms entries for tampered role field values or $0 order submissions marked as SUCCESS.

Impact Analysis

If exploited, this vulnerability could allow attackers to gain full administrative control of your WordPress site. This means they could install malicious plugins, steal sensitive data, modify site content, or completely take over your website. The attack is possible even with minimal initial access (Subscriber role) and doesn't require payment processing.

Compliance Impact

This vulnerability could severely impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data. If attackers gain admin access, they could exfiltrate personal data, modify records, or install backdoors that maintain persistent access. Organizations would need to report breaches and could face significant fines under these regulations.

Mitigation Strategies

Update the Knit Pay plugin to the latest version. Disable Gravity Forms integration if not needed. Restrict Subscriber-level access to trusted users. Monitor user role changes and form submissions for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89426. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart