Knit Pay Cashfree Instamojo Razorpay Paypal And More
Monthly
Privilege escalation in the Knit Pay WordPress plugin through 9.6.1.0 lets an authenticated attacker with Subscriber-level access and above promote their own account to administrator by tampering with the hidden role field of a Gravity Forms submission. The flaw requires the plugin's Gravity Forms integration to be active and a feed configured so that user_role_field_id points at a form field; the plugin then passes that attacker-controlled value directly to WP_User::set_role() with no allowlist validation, and the process is further helped by $0 orders being marked SUCCESS synchronously at submission and by the role-assignment fallback to $lead['created_by'], the submitter's own user ID. At time of analysis no public exploit code or CISA KEV entry was identified, but with CVSS 8.8 and an authenticated low-privilege prerequisite, this is a high-priority issue for any site running the vulnerable plugin together with a configured Gravity Forms feed.
Privilege escalation in the Knit Pay WordPress plugin through 9.6.1.0 lets an authenticated attacker with Subscriber-level access and above promote their own account to administrator by tampering with the hidden role field of a Gravity Forms submission. The flaw requires the plugin's Gravity Forms integration to be active and a feed configured so that user_role_field_id points at a form field; the plugin then passes that attacker-controlled value directly to WP_User::set_role() with no allowlist validation, and the process is further helped by $0 orders being marked SUCCESS synchronously at submission and by the role-assignment fallback to $lead['created_by'], the submitter's own user ID. At time of analysis no public exploit code or CISA KEV entry was identified, but with CVSS 8.8 and an authenticated low-privilege prerequisite, this is a high-priority issue for any site running the vulnerable plugin together with a configured Gravity Forms feed.