CVE-2026-3462: Frisbii Pay Plugin Authorization Bypass in WordPress

Technical summary

CVE-2026-3462 stems from missing capability checks in the 'upload_csv' and 'process_batch' functions within Frisbii Pay versions 1.8.9 and earlier. The vulnerability enables authenticated users at Subscriber level and above to bypass authorization controls, upload arbitrary CSV payloads, and modify WooCommerce postmeta and order meta records as well as payment token storage. The attack vector is network-based with low complexity; no user interaction is required beyond the attacker's authenticated access. The CVSS 3.1 score of 6.5 (MEDIUM) reflects high integrity impact with no confidentiality or availability risk.

Business impact

This vulnerability directly threatens the integrity of payment processing and order management in WordPress sites running vulnerable versions of Frisbii Pay. Attackers could corrupt customer payment tokens, manipulate order records, or redirect payment information—actions that erode customer trust, create compliance exposure (PCI-DSS, GDPR), and potentially trigger financial reconciliation issues. Sites processing payments through this plugin face operational disruption and reputational damage if exploited.

Affected systems

All Frisbii Pay plugin versions up to and including 1.8.9 are vulnerable. The plugin integrates with WooCommerce on WordPress installations. Any WordPress site with WooCommerce and an active Frisbii Pay installation at 1.8.9 or earlier is at risk, particularly those with loose user role management that grants Subscriber-level access to untrusted accounts.

Exploitability

Exploitability is straightforward. The vulnerability requires only authenticated access—a Subscriber-level account, the lowest privileged user role in WordPress. No special network conditions or user interaction are needed; the attack is triggered by direct API calls. The absence of capability checks makes the barrier to exploitation very low for anyone with a basic WordPress user account, whether through credential compromise, open registration, or intentional account creation.

Remediation

Upgrade the Frisbii Pay plugin to a patched version that restores capability checks on the vulnerable functions. Until patching is possible, restrict Subscriber-level role assignments and audit user account creation. Consider temporarily disabling the CSV upload feature or restricting it to Administrator accounts only via code modification if an immediate patch is unavailable.

Patch guidance

Monitor the Frisbii Pay plugin developer's repository and WordPress plugin directory for updated releases addressing CVE-2026-3462. Verify patch versions against the official Frisbii Pay advisory. Once a patched version is released, prioritize testing in a staging environment before deploying to production to ensure compatibility with your WooCommerce configuration and payment workflows.

Detection guidance

Monitor WordPress audit logs and WooCommerce activity logs for suspicious CSV uploads or batch processing operations initiated by low-privilege user accounts. Look for unexpected modifications to order meta, postmeta, and payment token records. Implement intrusion detection rules that flag 'process_batch' or 'upload_csv' function calls from non-administrative users. Review user role assignments to identify overprivileged Subscriber accounts that should not exist.

Why prioritize this

Although the CVSS score is MEDIUM (6.5), this vulnerability warrants urgent attention because it directly impacts payment data integrity in an e-commerce context. The low barrier to exploitation (Subscriber access) and absence of user interaction create a high practical risk for sites with open registration or loose account management. Organizations processing payments through WooCommerce should treat this as a near-term remediation priority.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects high integrity impact (unauthorized data modification of payment tokens and orders) combined with low complexity, network accessibility, and low privilege requirements. The score does not factor in confidentiality or availability loss, which explains why integrity-only impact yields a MEDIUM rating. However, in payment processing contexts, data integrity compromise carries outsized business risk.

Frequently asked questions