24 matches found
CVE-2026-89426
The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.6.1.0. This is due to the maybeupdateuserrole function reading the target role directly from an attacker-controlled Gravity Forms entry...
CVE-2026-89426 Knit Pay <= 9.6.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms Role Field
The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.6.1.0. This is due to the maybeupdateuserrole function reading the target role directly from an attacker-controlled Gravity Forms entry...
CVE-2026-89426
The Knit Pay WordPress plugin (versions up to and including 9.6.1.0 ) is vulnerable to Privilege Escalation . The root cause is the maybe_update_user_role() function, which reads a target role directly from an attacker-controlled Gravity Forms entry field (via user_role_field_id) and passes it to...
EUVD-2026-86579
The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.6.1.0. This is due to the maybeupdateuserrole function reading the target role directly from an attacker-controlled Gravity Forms entry...
CVE-2026-89426 Knit Pay <= 9.6.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms Role Field
The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.6.1.0. This is due to the maybeupdateuserrole function reading the target role directly from an attacker-controlled Gravity Forms entry...
CVE-2026-89426: Improper Privilege Management
The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.6.1.0. This is due to the maybeupdateuserrole function reading the target role directly from an attacker-controlled Gravity Forms entry...
PT-2026-98389
Name of the Vulnerable Software and Affected Versions Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress versions prior to 9.6.1.1 Description An issue exists where the maybe update user role function reads a target role from a Gravity Forms entry field, configured via...
WordPress Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin <= 9.6.1.0 - Authenticated (Subscriber+) Privilege Escalation vulnerability
Authenticated Subscriber+ Privilege Escalation vulnerability discovered by moonge in WordPress Plugin Knit Pay versions = 9.6.1.0...
CVE-2026-57717
Unauthenticated Broken Access Control in Knit Pay = 9.6.0.0 versions...
CVE-2026-57717
CVE-2026-57717 corresponds to an unauthenticated broken access control vulnerability in the WordPress Knit Pay plugin, affecting versions
CVE-2026-57717 WordPress Knit Pay plugin <= 9.6.0.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Knit Pay = 9.6.0.0 versions...
CVE-2026-57717 WordPress Knit Pay plugin <= 9.6.0.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Knit Pay = 9.6.0.0 versions...
EUVD-2026-48177
Unauthenticated Broken Access Control in Knit Pay = 9.6.0.0 versions...
CVE-2026-57717: Missing Authorization
Unauthenticated Broken Access Control in Knit Pay = 9.6.0.0 versions...
PT-2026-63835
Unauthenticated Broken Access Control in Knit Pay = 9.6.0.0 versions...
WordPress Knit Pay plugin <= 9.6.0.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Riyas M S in WordPress Plugin Knit Pay versions = 9.6.0.0...
CVE-2026-49070
Unauthenticated Broken Access Control in Knit Pay = 9.4.0.0 versions...
CVE-2026-49070 WordPress Knit Pay plugin <= 9.4.0.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Knit Pay = 9.4.0.0 versions...