Authenticated attackers can exploit a privilege management flaw in the Knit Pay WordPress plugin to escalate their access to administrator level.

This vulnerability is caused by the maybe_update_user_role() function, which fails to validate user-supplied role data against an allowlist. Authenticated attackers with Subscriber-level access can manipulate form submission data to grant themselves administrative privileges.

Successful exploitation allows an authenticated user to gain full administrative control over the WordPress installation. This leads to complete compromise of site data, the ability to install malicious plugins or themes, and potential total system takeover. With a CVSS score of 8.8, this vulnerability represents a high-severity risk that requires immediate attention to prevent unauthorized administrative access.

Immediate Action: Since a specific patched version is not explicitly confirmed in the provided data, users should monitor the WordPress plugin repository for updates beyond version 9.6.1.0 and apply them immediately. If an update is unavailable, deactivate the Knit Pay plugin until a secure version is released.

Proactive Monitoring: Review user account logs for suspicious activity, specifically looking for users who have had their roles elevated to Administrator without proper authorization.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block suspicious Gravity Forms submissions or unexpected modifications to user role parameters.

Public Exploit Available: Unknown.

Given the high CVSS score and the direct path to administrative privilege escalation, this vulnerability poses a significant risk to site integrity. Security teams should prioritize the identification of all instances of the Knit Pay plugin within their environment and prepare to update or disable the software immediately upon the release of a security patch.