CVE-2026-49070
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
In Knit Pay versions <= 9.4.0.0, there is an unauthenticated broken access control vulnerability that may allow unauthorized users to access resources.
Risk Assessment
Organizations may be exposed to unauthorized access to sensitive data, potentially leading to loss of confidentiality and integrity of information.
Recommendation
It is recommended to upgrade to the latest version of Knit Pay to mitigate this vulnerability and implement appropriate access control mechanisms.
Other vulnerabilities in Knit Pay
See all- CVE-2026-112821Medium
The Knit Pay plugin contains a missing authorization vulnerability allowing exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 9.6.3.0.
- CVE-2026-57717Medium
Knit Pay plugin version 9.6.0.0 and earlier has a broken access control vulnerability without authentication. An unauthenticated attacker can gain unauthorized access.
Original NVD description (English source)
Unauthenticated Broken Access Control in Knit Pay <= 9.4.0.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS