CVE-2026-112821: WordPress Knit Pay plugin <= 9.6.3.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in Knit Pay Knit Pay knit-pay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Knit Pay: from n/a through 9.6.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Knit Pay pluginto a version that resolves this vulnerability.Fixed in 9.6.3.1
Event History
Frequently Asked Questions
Which installations are affected?
The issue affects Knit Pay versions through 9.6.3.0. The available information does not identify a safe fixed version.
Does exploitation require authentication or user interaction?
No. The supplied CVSS vector indicates network-accessible exploitation with low complexity, no privileges required, and no user interaction.
What impact could successful exploitation have?
The CVSS vector indicates low confidentiality and integrity impact, with no availability impact. The issue is described as broken access control caused by missing authorization.