CVE-2026-49070: Knit Pay Auth Bypass Vulnerability

CVE-2026-49070 Overview

CVE-2026-49070 is an unauthenticated broken access control vulnerability in the Knit Pay WordPress plugin, affecting all versions up to and including 9.4.0.0. The flaw is classified under [CWE-862] Missing Authorization, allowing remote attackers to invoke protected plugin functionality without authentication. Patchstack tracks the issue in its WordPress vulnerability database. The CVSS vector indicates a network-reachable attack with no privileges or user interaction required, with impact focused on integrity.

Critical Impact
Unauthenticated remote attackers can interact with privileged Knit Pay functionality on WordPress sites, modifying payment-related data or plugin state without valid credentials.

Affected Products

Knit Pay WordPress plugin versions <= 9.4.0.0
WordPress sites with Knit Pay installed and active
Any WordPress deployment exposing the plugin endpoints to the internet

Discovery Timeline

2026-06-15 - CVE-2026-49070 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-49070

Vulnerability Analysis

The Knit Pay plugin exposes one or more action handlers that fail to enforce authorization checks before executing privileged logic. Under [CWE-862], the code path reaches sensitive operations without verifying the caller's identity, role, or capability. Because Knit Pay handles payment workflows, the missing check allows manipulation of integrity-sensitive state. The CVSS vector reports no confidentiality or availability impact, isolating the risk to unauthorized writes or state changes.

The EPSS probability for CVE-2026-49070 is 0.246% at the 15.5 percentile, reflecting limited observed exploitation signal at publication.

Root Cause

The root cause is missing authorization enforcement in plugin request handlers. WordPress plugins typically gate sensitive actions using current_user_can(), is_user_logged_in(), or nonce verification through check_ajax_referer(). In affected Knit Pay versions, at least one handler omits these checks, so requests from anonymous visitors execute the same code paths intended for privileged users.

Attack Vector

An attacker sends crafted HTTP requests to the vulnerable Knit Pay endpoint without supplying credentials. Because authentication is not required, the request reaches the unprotected handler and modifies integrity-sensitive data. The attack is fully remote and requires no user interaction or social engineering. Refer to the Patchstack Vulnerability Report for technical details on the affected request path.

Detection Methods for CVE-2026-49070

Indicators of Compromise

Unauthenticated POST or GET requests to Knit Pay plugin endpoints under /wp-admin/admin-ajax.php or /wp-json/ with knit-pay or knit_pay action parameters
Unexpected modifications to Knit Pay configuration, transaction records, or payment gateway settings without a corresponding administrator login
Spikes in traffic to plugin handlers from a single IP or distributed source absent valid session cookies

Detection Strategies

Audit WordPress access logs for requests targeting Knit Pay actions where the request lacks an authenticated wordpress_logged_in_* cookie
Correlate plugin database table changes against authenticated administrator sessions to surface unauthorized writes
Deploy WAF rules that flag access to Knit Pay AJAX or REST endpoints from anonymous sources

Monitoring Recommendations

Enable verbose request logging on the web server for /wp-admin/admin-ajax.php and /wp-json/knit-pay/* paths
Alert on changes to plugin options stored in wp_options keys prefixed with knit_pay_
Monitor outbound payment gateway API calls for anomalies tied to manipulated plugin state

How to Mitigate CVE-2026-49070

Immediate Actions Required

Update Knit Pay to a version later than 9.4.0.0 once the vendor publishes a patched release
Restrict access to WordPress admin and plugin endpoints using IP allowlisting where feasible
Audit Knit Pay configuration and transaction history for unauthorized modifications since the affected version was installed

Patch Information

The vulnerability is reported against Knit Pay versions up to and including 9.4.0.0. Administrators should consult the Patchstack Vulnerability Report for the current fixed version and upgrade guidance.

Workarounds

Deactivate the Knit Pay plugin on production sites until a patched version is installed and verified
Apply virtual patching at the WAF layer to block unauthenticated requests targeting Knit Pay action handlers
Enforce HTTP authentication or IP restrictions on /wp-admin/admin-ajax.php and Knit Pay REST routes

bash

# Example WAF rule (ModSecurity) blocking unauthenticated Knit Pay AJAX calls
SecRule REQUEST_URI "@rx /wp-admin/admin-ajax\.php" \
    "chain,id:1049070,phase:1,deny,status:403,log,msg:'CVE-2026-49070 Knit Pay unauth access'"
  SecRule ARGS:action "@rx ^knit[_-]pay" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"