Knit Pay CVE-2026-112821

Exploitation requires that a vulnerable Knit Pay plugin version (any release up to and including 9.6.3.0) be installed and active on a network-reachable WordPress site. Per CVSS PR:N/UI:N the affected action is reachable by unauthenticated attackers without user interaction, reflecting a broken/missing access-control check (CWE-862). The specific endpoint, parameter, or plugin feature that lacks the authorization check is not described in the available sources, so the exact trigger is unconfirmed. Limiting factors: only sites running this specific plugin at or below 9.6.3.0 are affected, and impact is limited to low confidentiality and low integrity with no availability effect, bounding what an attacker can achieve.

This is a medium-severity missing-authorization flaw (CWE-862) in the Knit Pay WordPress plugin, scored CVSS 6.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - network-reachable, low complexity, and no privileges or user interaction required, implying unauthenticated access to functionality that should be access-controlled. Impact is partial: low confidentiality and low integrity, no availability impact, no scope change, which is why it lands at 6.5 rather than critical. The vuln.today decision label is 'this_month' (a moderate-urgency, non-emergency priority), consistent with the moderate score. There is no CISA KEV listing, no EPSS probability supplied, and no confirmed public exploit - the only reference is the Patchstack advisory that catalogs the issue, not working exploit code, so there is no public exploit identified at time of analysis. The signals are internally consistent (network/unauthenticated per CVSS, broken-access-control per CWE and tags) and point to a real but bounded issue rather than an urgent mass-exploitation threat: worth patching within the normal cycle, not an emergency. Key missing data: no EPSS, no independent fix-version confirmation, and the description does not specify which endpoint or action is exposed.

A remote, unauthenticated attacker sends a direct request to a Knit Pay plugin endpoint whose access control is missing or misconfigured, reaching an action normally restricted to authorized users. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this requires only network reachability to the WordPress site and no login or user interaction, allowing the attacker to read or alter a limited set of plugin-managed data. No public exploit code is identified at time of analysis; only the Patchstack advisory reference exists.