{"id":"CVE-2026-3462","aliases":["EUVD-2026-39958","GHSA-mxv8-m55g-xf4p"],"status":"published","title":"Frisbii Pay \u003c= 1.8.9 - Missing Authorization to Authenticated (Subscriber+) Payment Token Modification","description":"The Frisbii Pay plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'upload_csv' and 'process_batch' functions in all versions up to, and including, 1.8.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary CSV data and overwrite WooCommerce payment tokens, postmeta, and order meta records.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00389,"percentile":0.33236,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-862"],"published":"2026-06-27T06:50:59Z","modified":"2026-06-29T18:40:23Z","exploits":[{"source":"pocgithub","id":"open-flaw/CVE-2026-3462","title":"open-flaw/CVE-2026-3462","date":"2026-04-20","url":"https://github.com/open-flaw/CVE-2026-3462"}],"products":[{"vendor":"frisbii","product":"frisbii pay"},{"vendor":"reepaydenmark","product":"frisbii pay"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf1ca22a-7fb6-457c-bde0-83f6744185be?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/reepay-checkout-gateway/trunk/includes/Admin/MigrationMobilepayToVipps.php#L42"},{"url":"https://plugins.trac.wordpress.org/browser/reepay-checkout-gateway/trunk/includes/Admin/MigrationMobilepayToVipps.php#L129"},{"url":"https://plugins.trac.wordpress.org/browser/reepay-checkout-gateway/trunk/includes/Admin/MigrationMobilepayToVipps.php#L170"},{"url":"https://plugins.trac.wordpress.org/changeset/3485246/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3462"},{"url":"https://plugins.trac.wordpress.org/changeset/3485246"},{"url":"https://github.com/advisories/GHSA-mxv8-m55g-xf4p"}],"sources":{"cve":[{"id":"CVE-2026-3462","title":"Frisbii Pay \u003c= 1.8.9 - Missing Authorization to Authenticated (Subscriber+) Payment Token Modification","description":"The Frisbii Pay plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'upload_csv' and 'process_batch' functions in all versions up to, and including, 1.8.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary CSV data and overwrite WooCommerce payment tokens, postmeta, and order meta records.","status":"published","published":"2026-06-27T06:50:59.41Z","modified":"2026-06-29T13:12:52.192Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T13:48:58.05327Z"}],"euvd":[{"id":"EUVD-2026-39958","description":"The Frisbii Pay plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'upload_csv' and 'process_batch' functions in all versions up to, and including, 1.8.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary CSV data and overwrite WooCommerce payment tokens, postmeta, and order meta records.","status":"published","published":"2026-06-27T06:50:59Z","modified":"2026-06-29T13:12:52Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:22.87152Z"}],"ghsa":[{"id":"GHSA-mxv8-m55g-xf4p","title":"The Frisbii Pay plugin for WordPress is vulnerable to unauthorized modification of data due to...","description":"The Frisbii Pay plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'upload_csv' and 'process_batch' functions in all versions up to, and including, 1.8.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary CSV data and overwrite WooCommerce payment tokens, postmeta, and order meta records.","status":"published","published":"2026-06-27T09:30:37Z","modified":"2026-06-27T09:30:45Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:09:01.878033Z"}],"nvd":[{"id":"CVE-2026-3462","description":"The Frisbii Pay plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'upload_csv' and 'process_batch' functions in all versions up to, and including, 1.8.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary CSV data and overwrite WooCommerce payment tokens, postmeta, and order meta records.","status":"published","published":"2026-06-27T08:16:44.923Z","modified":"2026-06-29T18:40:23.203Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:26.508751Z"}]}}