Missing Authorization vulnerability in the WordPress Knit Pay plugin allows an attacker to bypass configured security levels, granting unauthorized access to privileged plugin functions. Exploitation can enable manipulation of payment processing, configuration changes, or access to sensitive data within the plugin. The flaw is rooted in CWE-862, indicating that access control checks are insufficient, allowing privilege escalation within the WordPress environment.

The affected product is the WordPress Knit Pay plugin, also known simply as Knit Pay, for WordPress sites. Versions ranging from the earliest released versions up through 9.6.3.0 are impacted. Any WordPress installation that has this plugin version or earlier, and is accessible via its administrative interface, is considered vulnerable.

The severity of this issue is measured by a CVSS score of 6.5, indicating medium impact. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector involves any authenticated user attempting to use the plugin’s administrative functions; the missing authorization check allows such a user to perform actions normally reserved for higher‑privilege accounts. Successful exploitation could lead to unauthorized changes to payment settings, potential fraud, and compromise of data integrity.