CVE-2026-3462
Received Received - Intake

Unauthorized Data Modification in Frisbii Pay WordPress Plugin

Publication date: 2026-06-27

Last updated on: 2026-06-27

Assigner: Wordfence

Description
The Frisbii Pay plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'upload_csv' and 'process_batch' functions in all versions up to, and including, 1.8.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary CSV data and overwrite WooCommerce payment tokens, postmeta, and order meta records.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-06-27
Last Modified
2026-06-27
Generated
2026-06-27
AI Q&A
2026-06-27
EPSS Evaluated
N/A
NVD
CVE-2026-3462
EUVD
EUVD-2026-39958

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
frisbii pay to 1.8.9 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Frisbii Pay plugin for WordPress has a vulnerability due to missing capability checks on its 'upload_csv' and 'process_batch' functions in all versions up to and including 1.8.9.

This flaw allows authenticated users with Subscriber-level access or higher to upload arbitrary CSV data.

As a result, these attackers can overwrite WooCommerce payment tokens, postmeta, and order meta records without proper authorization.

Impact Analysis

This vulnerability can lead to unauthorized modification of sensitive e-commerce data within a WordPress site using the Frisbii Pay plugin.

Attackers with low-level access can overwrite WooCommerce payment tokens and order-related metadata, potentially disrupting payment processes and order integrity.

Such unauthorized changes could result in financial fraud, data corruption, or loss of trust from customers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-3462. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart