Skip to content
OpenAdvisories
Medium · 6.5 Public exploit CVE-2026-3462 EUVD-2026-39958GHSA-mxv8-m55g-xf4p

Frisbii Pay <= 1.8.9 - Missing Authorization to Authenticated (Subscriber+) Payment Token Modification

Published Jun 27, 2026 · Updated Jun 29, 2026 · Assigned by Wordfence

Vendor: reepaydenmark Product: Frisbii Pay Category: Web / CMS

Description

The Frisbii Pay plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'upload_csv' and 'process_batch' functions in all versions up to, and including, 1.8.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary CSV data and overwrite WooCommerce payment tokens, postmeta, and order meta records.

Affected products

VendorProductAffectedFixed
reepaydenmark Frisbii Pay ≤ 1.8.9 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • open-flaw/CVE-2026-3462 ★ 0 · Apr 20, 2026

    Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References