What is the CVSS score of CVE-2026-49070?

CVE-2026-49070 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Knit Pay are affected by CVE-2026-49070?

The Knit Pay WordPress payment plugin (versions 9.4.0.0 and earlier) contains an unauthenticated access control vulnerability enabling remote attackers to modify payment transaction data without…

How to fix or mitigate CVE-2026-49070?

Within 24 hours: Identify all WordPress installations running Knit Pay plugin; document installed versions; assess business criticality of payment processing. Within 7 days: Deploy compensating controls-implement WAF rules blocking unauthenticated plugin endpoint access, restrict admin panel to authorized IP ranges, enable transaction logging with real-time SIEM alerting for modifications, or disable plugin if payment processing is not actively required. Within 30 days: Monitor vendor announcements for patch availability; prepare migration strategy to alternative payment processors if no patch issued. Exploitation status: no public exploit identified at time of analysis.

Knit Pay CVE-2026-49070

EUVD-2026-36876 HIGH

Missing Authorization (CWE-862)

2026-06-15 Patchstack

GHSA-f972-34qc-543f

WordPress Authentication Bypass Wordpress Plugin Knit Pay

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable WordPress plugin endpoint (AV:N/AC:L/PR:N/UI:N); broken access control on a state-changing action yields I:H with no disclosure or downtime, so C:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 21:37 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in Knit Pay <= 9.4.0.0 versions.

AnalysisAI

Unauthenticated broken access control in the Knit Pay WordPress plugin versions 9.4.0.0 and earlier allows remote attackers to modify integrity-sensitive data without any authentication or user interaction. The flaw is rooted in missing authorization checks (CWE-862) on plugin endpoints, and while no public exploit identified at time of analysis, the network-reachable nature and zero prerequisites make it attractive for opportunistic abuse against WordPress sites running this payment plugin.

Technical ContextAI

Knit Pay is a WordPress payment-gateway plugin (CPE cpe:2.3:a:knit_pay:knit_pay) that integrates third-party Indian payment processors into WordPress sites. The underlying weakness is CWE-862 Missing Authorization, meaning one or more plugin actions - typically exposed via WordPress admin-ajax, REST routes, or admin-post handlers - execute privileged operations without verifying the caller's capability (current_user_can) or nonce. In WordPress plugins of this class, such gaps commonly surface in configuration, transaction-record, or webhook endpoints where the developer assumed an authenticated admin context but registered the hook on a public action.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed from the provided data, so site operators should consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/knit-pay/vulnerability/wordpress-knit-pay-plugin-9-4-0-0-broken-access-control-vulnerability and update Knit Pay to any version greater than 9.4.0.0 as soon as the vendor publishes one on the WordPress.org plugin repository. As compensating controls until a patched release is verified, restrict access to /wp-admin/admin-ajax.php and the plugin's REST namespace via a WAF rule or .htaccess deny for unauthenticated callers (side effect: may break legitimate front-end checkout flows that rely on the plugin's AJAX handlers), deactivate the Knit Pay plugin if payment processing is not currently in production use, and audit recent plugin-related database writes for unauthorized modifications.