What is the CVSS score of CVE-2026-57717?

CVE-2026-57717 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Knit Pay CVE-2026-57717

EUVD-2026-48177 MEDIUM

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-93r7-2pv2-57hc

WordPress Authentication Bypass Wordpress Plugin Knit Pay

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Network-accessible unauthenticated endpoint (AV:N, PR:N, UI:N); no scope change; only limited integrity and availability disruption, no confidentiality impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:06 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in Knit Pay <= 9.6.0.0 versions.

AnalysisAI

Unauthenticated broken access control in the Knit Pay WordPress payment plugin (versions <= 9.6.0.0) allows remote, unauthenticated attackers to perform unauthorized actions resulting in limited integrity and availability impact against affected WordPress installations. The CVSS vector (PR:N, AV:N, AC:L, UI:N) confirms no authentication or user interaction is required, lowering the exploitation barrier significantly. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, unauthenticated attack surface warrants prompt remediation on any publicly accessible WordPress deployment running this plugin.

Technical ContextAI

Knit Pay is a WordPress plugin providing payment gateway integration for WooCommerce and other WordPress-based e-commerce setups. The affected product is identified by CPE cpe:2.3:a:knitpay:knit_pay:*:*:*:*:*:*:*:* covering all versions through 9.6.0.0. The root cause is CWE-862 (Missing Authorization) - the plugin exposes one or more endpoints or action handlers without verifying whether the requesting party has the necessary privilege to invoke them. In WordPress, this commonly manifests as REST API endpoints or AJAX handlers (admin-ajax.php) registered without capability checks (e.g., missing current_user_can() guards or nonce validation tied to privilege level), allowing any visitor to trigger privileged operations.

RemediationAI

Update the Knit Pay plugin to a version beyond 9.6.0.0 via the WordPress admin dashboard or by manually downloading the patched release from the WordPress plugin repository. The exact fixed version is not independently confirmed in the available data - consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/knit-pay/vulnerability/wordpress-knit-pay-plugin-9-6-0-0-broken-access-control-vulnerability and the plugin's changelog for the precise remediated release. If immediate patching is not possible, a compensating control is to deactivate the Knit Pay plugin until the patch is applied, accepting the trade-off of losing payment gateway functionality. Alternatively, if only specific endpoints are exploitable, a WAF rule restricting unauthenticated POST requests to affected plugin endpoints may reduce exposure, though this requires knowledge of the specific vulnerable endpoint - which is not disclosed in current public data.