Knit Pay <= 9.6.3.0 - Unauthenticated Insecure Direct Object Reference via PayPal Order Creation and Capture
- ID
- WPSEC-2026-1311
- Plugin
- Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more (knit-pay)
- Affected
- all versions before 9.6.3.1
- Remediation
- Update to 9.6.3.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-21
- Attack surface
- Knit Pay on WPSec AttackSurface
- Fix released
- Published
Description
The Knit Pay plugin for WordPress is vulnerable to Insecure Direct Object Reference via the knitpay_paypal_create_order and knitpay_paypal_capture_order AJAX actions in all versions up to, and including, 9.6.3.0, due to the handlers checking a single checkout nonce shared by every payment and never verifying that the supplied 'payment_id' belongs to the requester. This makes it possible for unauthenticated attackers who get a checkout nonce from any PayPal payment page, such as one for a payment they started themselves, to act on other customers' payments. They can create PayPal orders for those payments and overwrite their transaction IDs, read the associated PayPal order IDs, and trigger status updates that can mark pending payments as cancelled.
References
- https://wpsec.com/vuln/WPSEC-2026-1311/
- https://plugins.svn.wordpress.org/knit-pay/tags/9.6.3.1/
- https://wordpress.org/plugins/knit-pay/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS