CVE-2026-112821
MediumCVSS 6.5Summary
The Knit Pay plugin contains a missing authorization vulnerability allowing exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 9.6.3.0.
Risk Assessment
An attacker may perform unauthorized payment-related or configuration operations in the plugin. This may lead to financial abuse or data compromise.
Recommendation
Update the Knit Pay plugin to a version later than 9.6.3.0 if available, or implement additional authorization mechanisms. Review the plugin's permission configuration.
Other vulnerabilities in Knit Pay
See all- CVE-2026-57717Medium
Knit Pay plugin version 9.6.0.0 and earlier has a broken access control vulnerability without authentication. An unauthenticated attacker can gain unauthorized access.
- CVE-2026-49070High
In Knit Pay versions <= 9.4.0.0, there is an unauthenticated broken access control vulnerability that may allow unauthorized users to access resources.
Original NVD description (English source)
Missing Authorization vulnerability in Knit Pay Knit Pay knit-pay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Knit Pay: from n/a through 9.6.3.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS