CVE-2026-3462

Frisbii Pay <= 1.8.9 - Missing Authorization to Authenticated (Subscriber+) Payment Token Modification

The Frisbii Pay plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'upload_csv' and 'process_batch' functions in all versions up to, and including, 1.8.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary CSV data and overwrite WooCommerce payment tokens, postmeta, and order meta records.

Affected

reepaydenmark · Frisbii Pay

CVSS v3.1 WORDFENCE

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS

0.39% chance of exploitation in the next 30 days, 31st percentile

Published

2026-06-27

Updated

2026-06-29

Proof-of-concept exploits (1)

• open-flaw/CVE-2026-34620★ · 2026-04-20

References

• CVE Record
• NVD entry

Related

• CVE-2017-11499
• CVE-2020-8158
• CVE-2022-33171
• CVE-2024-53900
• CVE-2025-12758
• CVE-2025-23061