What is the CVSS score of CVE-2026-3462?

CVE-2026-3462 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

Frisbii Pay CVE-2026-3462

EUVD-2026-39958 MEDIUM

Missing Authorization (CWE-862)

2026-06-27 Wordfence

GHSA-mxv8-m55g-xf4p

WordPress Authentication Bypass Wordpress Plugin Frisbii Pay

6.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Subscriber-level authentication (PR:L) is the only barrier; network-reachable AJAX endpoint with no complexity; integrity-only impact as payment data is overwritten but not disclosed.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 27, 2026 - 07:50 vuln.today

CVE Published

Jun 27, 2026 - 06:50 cve.org

MEDIUM 6.5

DescriptionCVE.org

The Frisbii Pay plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'upload_csv' and 'process_batch' functions in all versions up to, and including, 1.8.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary CSV data and overwrite WooCommerce payment tokens, postmeta, and order meta records.

AnalysisAI

Unauthorized data modification in the Frisbii Pay WordPress plugin (versions up to and including 1.8.9) allows authenticated attackers at Subscriber level or above to overwrite WooCommerce payment tokens, postmeta, and order meta records via unprotected AJAX endpoints. The root cause is CWE-862 (Missing Authorization) - the plugin's upload_csv and process_batch functions in the MigrationMobilepayToVipps class perform no WordPress capability checks before processing caller-supplied CSV data. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the low privilege barrier (Subscriber) makes it meaningful in multi-tenant or open-registration WordPress environments.

Technical ContextAI

The vulnerability resides in the MigrationMobilepayToVipps.php class (visible at the WordPress plugin trac browser at lines 42, 129, and 170), which handles migration of payment method data from MobilePay to Vipps within the Reepay/Frisbii checkout gateway. WordPress capability checks (e.g., current_user_can('manage_woocommerce')) are absent on the upload_csv and process_batch action handlers, meaning any authenticated user - including the lowest-privilege Subscriber role - can trigger these functions. CWE-862 (Missing Authorization) describes exactly this pattern: a protected operation is exposed without verifying the caller holds the required permission. The affected CPE is cpe:2.3:a:reepaydenmark:frisbii_pay:*:*:*:*:*:*:*:*, and the plugin is tightly coupled to WooCommerce, requiring WooCommerce to be active for the payment token and order meta write paths to exist.

RemediationAI

An upstream code fix has been committed to the WordPress plugin repository as changeset 3485246 (https://plugins.trac.wordpress.org/changeset/3485246/); however, the exact patched release version number is not independently confirmed from the available data - site owners should verify the current plugin version in the WordPress plugin repository changelog and update to any version above 1.8.9 once a tagged release incorporating the changeset is confirmed. As an immediate compensating control, administrators should disable user self-registration (Settings > General > uncheck 'Anyone can register') to prevent external attackers from obtaining the Subscriber-level account required for exploitation - note this affects all plugin functionality relying on open registration. Additionally, a WAF rule blocking POST requests to the upload_csv and process_batch action parameters (e.g., via Wordfence's built-in firewall) can block exploitation without disrupting normal site operation. Monitor WooCommerce payment token and order meta tables for unexpected modifications as a detection signal.