# Knit Pay <= 9.6.3.0 - Unauthenticated Insecure Direct Object Reference via PayPal Order Creation and Capture

- **ID:** WPSEC-2026-1311
- **Plugin:** Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more (`knit-pay`), https://wordpress.org/plugins/knit-pay/
- **Affected versions:** all versions before 9.6.3.1
- **Fixed in:** 9.6.3.1 (Update to 9.6.3.1 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/knit-pay
- **Fix released:** 2026-10-19
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1311/

## Description

The Knit Pay plugin for WordPress is vulnerable to Insecure Direct Object Reference via the knitpay_paypal_create_order and knitpay_paypal_capture_order AJAX actions in all versions up to, and including, 9.6.3.0, due to the handlers checking a single checkout nonce shared by every payment and never verifying that the supplied 'payment_id' belongs to the requester. This makes it possible for unauthenticated attackers who get a checkout nonce from any PayPal payment page, such as one for a payment they started themselves, to act on other customers' payments. They can create PayPal orders for those payments and overwrite their transaction IDs, read the associated PayPal order IDs, and trigger status updates that can mark pending payments as cancelled.

## References

- https://wpsec.com/vuln/WPSEC-2026-1311/
- https://plugins.svn.wordpress.org/knit-pay/tags/9.6.3.1/
- https://wordpress.org/plugins/knit-pay/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1311/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.