CVE-2026-89426 (GCVE-0-2026-89426)
Vulnerability from cvelistv5
Published
2026-09-25 07:40
Modified
2026-09-25 13:00
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-269 - Improper Privilege Management
Summary
The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.6.1.0. This is due to the `maybe_update_user_role()` function reading the target role directly from an attacker-controlled Gravity Forms entry field — configured via the feed's `user_role_field_id` — and passing it to `WP_User::set_role()` without validating the supplied value against an allowlist of permitted roles. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to administrator by tampering with the hidden role field value at form submission time. Exploitation is further enabled by the fact that $0 orders are synchronously marked as SUCCESS during form submission without requiring a real payment, and when no GF User Registration user can be resolved, the role assignment target falls back to `$lead['created_by']` — the currently authenticated submitter's own user ID — making any authenticated form submitter an eligible exploitation target.
References
Impacted products
Vendor Product Version
knitpay Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more Version: 0   ≤ 9.6.1.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89426",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-25T12:49:41.552995Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-25T13:00:13.780Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Knit Pay \u2013 Cashfree, Instamojo, Razorpay, PayPal and more",
          "vendor": "knitpay",
          "versions": [
            {
              "lessThanOrEqual": "9.6.1.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "moonge"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Knit Pay \u2013 Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.6.1.0. This is due to the `maybe_update_user_role()` function reading the target role directly from an attacker-controlled Gravity Forms entry field \u2014 configured via the feed\u0027s `user_role_field_id` \u2014 and passing it to `WP_User::set_role()` without validating the supplied value against an allowlist of permitted roles. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to administrator by tampering with the hidden role field value at form submission time. Exploitation is further enabled by the fact that $0 orders are synchronously marked as SUCCESS during form submission without requiring a real payment, and when no GF User Registration user can be resolved, the role assignment target falls back to `$lead[\u0027created_by\u0027]` \u2014 the currently authenticated submitter\u0027s own user ID \u2014 making any authenticated form submitter an eligible exploitation target."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T07:40:30.779Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ee5df686-7bf8-42cc-9356-92570bd02355?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/knit-pay/tags/9.6.1.0/packages/wp-pay-extensions/gravityforms/src/Extension.php#L384"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/knit-pay/tags/9.6.1.0/packages/wp-pay-extensions/gravityforms/src/Extension.php#L381"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/knit-pay/tags/9.6.1.0/packages/wp-pay-extensions/gravityforms/src/Extension.php#L989"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/knit-pay/tags/9.6.1.0/packages/wp-pay-extensions/gravityforms/src/Processor.php#L493"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/knit-pay/tags/9.4.0.1/packages/wp-pay-extensions/gravityforms/src/Extension.php#L384"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/knit-pay/tags/9.4.0.1/packages/wp-pay-extensions/gravityforms/src/Extension.php#L381"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/knit-pay/tags/9.4.0.1/packages/wp-pay-extensions/gravityforms/src/Extension.php#L989"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/knit-pay/tags/9.4.0.1/packages/wp-pay-extensions/gravityforms/src/Processor.php#L493"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3706862%40knit-pay\u0026new=3706862%40knit-pay"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-21T07:48:40.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-24T18:42:55.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Knit Pay \u003c= 9.6.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms Role Field"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-89426",
    "datePublished": "2026-09-25T07:40:30.779Z",
    "dateReserved": "2026-09-11T18:34:23.074Z",
    "dateUpdated": "2026-09-25T13:00:13.780Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-89426\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-25T12:49:41.552995Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-25T12:55:42.752Z\"}}], \"cna\": {\"title\": \"Knit Pay \u003c= 9.6.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms Role Field\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"moonge\"}], \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}}], \"affected\": [{\"vendor\": \"knitpay\", \"product\": \"Knit Pay \\u2013 Cashfree, Instamojo, Razorpay, PayPal and more\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"9.6.1.0\"}], \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-09-21T07:48:40.000Z\", \"value\": \"Vendor Notified\"}, {\"lang\": \"en\", \"time\": \"2026-09-24T18:42:55.000Z\", \"value\": \"Disclosed\"}], \"references\": [{\"url\": \"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee5df686-7bf8-42cc-9356-92570bd02355?source=cve\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/knit-pay/tags/9.6.1.0/packages/wp-pay-extensions/gravityforms/src/Extension.php#L384\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/knit-pay/tags/9.6.1.0/packages/wp-pay-extensions/gravityforms/src/Extension.php#L381\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/knit-pay/tags/9.6.1.0/packages/wp-pay-extensions/gravityforms/src/Extension.php#L989\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/knit-pay/tags/9.6.1.0/packages/wp-pay-extensions/gravityforms/src/Processor.php#L493\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/knit-pay/tags/9.4.0.1/packages/wp-pay-extensions/gravityforms/src/Extension.php#L384\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/knit-pay/tags/9.4.0.1/packages/wp-pay-extensions/gravityforms/src/Extension.php#L381\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/knit-pay/tags/9.4.0.1/packages/wp-pay-extensions/gravityforms/src/Extension.php#L989\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/knit-pay/tags/9.4.0.1/packages/wp-pay-extensions/gravityforms/src/Processor.php#L493\"}, {\"url\": \"https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3706862%40knit-pay\u0026new=3706862%40knit-pay\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The Knit Pay \\u2013 Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.6.1.0. This is due to the `maybe_update_user_role()` function reading the target role directly from an attacker-controlled Gravity Forms entry field \\u2014 configured via the feed\u0027s `user_role_field_id` \\u2014 and passing it to `WP_User::set_role()` without validating the supplied value against an allowlist of permitted roles. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to administrator by tampering with the hidden role field value at form submission time. Exploitation is further enabled by the fact that $0 orders are synchronously marked as SUCCESS during form submission without requiring a real payment, and when no GF User Registration user can be resolved, the role assignment target falls back to `$lead[\u0027created_by\u0027]` \\u2014 the currently authenticated submitter\u0027s own user ID \\u2014 making any authenticated form submitter an eligible exploitation target.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-269\", \"description\": \"CWE-269 Improper Privilege Management\"}]}], \"providerMetadata\": {\"orgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"shortName\": \"Wordfence\", \"dateUpdated\": \"2026-09-25T07:40:30.779Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-89426\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-25T13:00:13.780Z\", \"dateReserved\": \"2026-09-11T18:34:23.074Z\", \"assignerOrgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"datePublished\": \"2026-09-25T07:40:30.779Z\", \"assignerShortName\": \"Wordfence\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.