CVE-2026-89426 is a privilege escalation vulnerability in the Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more WordPress plugin affecting all versions up to and including 9.6.1.0. The vulnerability is due to improper privilege management (CWE-269) where the maybe_update_user_role() function reads the target user role directly from an attacker-controlled Gravity Forms entry field configured via user_role_field_id. The role value is passed to WP_User::set_role() without validation against an allowlist of permitted roles, enabling authenticated attackers with Subscriber-level access or above to escalate their privileges to administrator by tampering with the hidden role field during form submission. Additionally, zero-dollar orders are marked as successful synchronously without requiring real payment, and when no Gravity Forms User Registration user can be resolved, the role assignment falls back to the submitter's own user ID, making exploitation feasible for any authenticated form submitter.

Successful exploitation allows an authenticated user with Subscriber-level or higher access to escalate their privileges to administrator, gaining full control over the WordPress site. This can lead to complete compromise of the site, including data theft, site defacement, or further malicious activity. The vulnerability has a high CVSS score of 8.8, reflecting its critical impact on confidentiality, integrity, and availability.

No official patch or fix is currently referenced in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected plugin and consider disabling it if possible. Monitor for updates from the vendor and apply official patches promptly once released. Avoid using the plugin on publicly accessible sites without additional access controls.