---
id: "CVE-2026-112821"
kind: "vulnerability"
aliases: ["CVE-2026-112821"]
title: "Knit Pay WordPress plugin: missing authorization check exposes access-control bypass"
severity: "medium"
cvss: 6.5
epss: 0.00159
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["knit-pay", "package", "payments", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-23T09:17:05+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T03:47:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112821", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-112821", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Knit Pay WordPress plugin: missing authorization check exposes access-control bypass

Knit Pay, a payment plugin, lacks an authorization check on at least one function, so an attacker may reach functionality meant for privileged users. The sources affirm the flaw exists in versions through 9.6.3.0 but do not state the exact action an attacker can perform.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Knit Pay version in the plugin list or the plugin's main file header, and compare with `9.6.3.0`
- unknown for further checks: the sources do not name the affected endpoint or setting

## Fix

- Update Knit Pay to a version later than `9.6.3.0` once a fixed release is published; the sources do not name the fixed version

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112821
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-112821

## From the sources

Missing Authorization vulnerability in Knit Pay Knit Pay knit-pay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Knit Pay: from n/a through 9.6.3.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_