← Back to the live CVE advisory feed

CVE-2026-89426: Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more

Severity

8.8 (HIGH)

Vendor

KNITPAY

Affected versions

0 through 9.6.1.0

Patch status

Unknown

Published

2026-09-25T08:16:40.940

Modified

2026-09-25T08:16:40.940

Why it matters

This matters because the affected product may be exposed on public websites. A vulnerable plugin can create a direct path to site compromise, malicious code deployment, or data theft.

Recommended admin actions

• Review and patch based on exposure, asset criticality, and business impact.
• Check whether the affected WordPress plugin or theme is installed.
• Update, disable, or remove the affected component if present.

Technical summary

The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.6.1.0. This is due to the `maybe_update_user_role()` function reading the target role directly from an attacker-controlled Gravity Forms entry field — configured via the feed's `user_role_field_id` — and passing it to `WP_User::set_role()` without validating the supplied value against an allowlist of permitted roles. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to administrator by tampering with the hidden role field value at form submission time. Exploitation is further enabled by the fact that $0 orders are synchronously marked as SUCCESS during form submission without requiring a real payment, and when no GF User Registration user can be resolved, the role assignment target falls back to `$lead['created_by']` — the currently authenticated submitter's own user ID — making any authenticated form submitter an eligible exploitation target.

View the official NVD record for CVE-2026-89426

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.