Junglewise Threat Intelligence

CVE-2026-3462: Frisbii Pay WordPress plugin unauthorized data modification

CVE-2026-3462 · Severity: medium · CVSS 6.5 · Published 2026-06-27

Executive brief

Frisbii Pay is a WordPress plugin used to process payments through WooCommerce. A security flaw allows any logged-in user, even those with low-level 'Subscriber' permissions, to upload data that can overwrite sensitive transaction information. This could lead to the corruption of payment tokens and order records, potentially disrupting business operations and financial tracking.

Technical details

The Frisbii Pay plugin for WordPress (formerly Reepay Checkout Gateway) contains a missing authorization vulnerability (CWE-862) within the 'upload_csv' and 'process_batch' functions located in the MigrationMobilepayToVipps.php component. Due to a lack of capability checks, authenticated attackers with Subscriber-level access or higher can invoke these functions via network requests. An attacker can upload arbitrary CSV data to overwrite critical WooCommerce metadata, including payment tokens, postmeta, and order meta records. This vulnerability affects all versions up to and including 1.8.9; a patch was introduced in changeset 3485246.

Affected products

  • reepaydenmark Frisbii Pay (formerly Reepay Checkout Gateway) up to, and including, 1.8.9

Timeline

  • 2026-06-27: disclosed
  • 2026-06-27: advisory

References