What is the CVSS score of CVE-2026-56038?

CVE-2026-56038 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Frisbii Pay are affected by CVE-2026-56038?

The Frisbii Pay WordPress plugin (versions ≤1.8.2) enables authenticated Contributor-level users to escalate to administrative privileges, creating a backdoor to complete site control.

How to fix or mitigate CVE-2026-56038?

Within 24 hours: identify all WordPress installations running Frisbii Pay plugin ≤1.8.2. Within 7 days: either remove the plugin and deploy an alternative payment processor, or immediately revoke all non-critical Contributor role assignments and restrict role-assignment permissions to administrators only while enabling user activity logging to detect escalation attempts. Within 30 days: monitor vendor advisories for patch availability and apply immediately upon release.

Frisbii Pay CVE-2026-56038

EUVD-2026-39700 HIGH

Missing Authorization (CWE-862)

2026-06-26 audit@patchstack.com

GHSA-6hv7-34w5-9r7h

WordPress Authentication Bypass Privilege Escalation Wordpress Plugin

8.8

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable WordPress endpoint, low complexity, requires a low-privilege Contributor account (PR:L), no user interaction; missing authorization yields full site takeover so C/I/A all High.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:44 vuln.today

DescriptionCVE.org

Contributor Privilege Escalation in Frisbii Pay <= 1.8.2 versions.

AnalysisAI

Privilege escalation in the Frisbii Pay (reepay-checkout-gateway) WordPress plugin through version 1.8.2 allows a low-privileged authenticated user holding a Contributor role to elevate to higher privileges due to a missing authorization check. Reported through Patchstack's audit program and tagged as both Authentication Bypass and Privilege Escalation, the flaw carries a CVSS 8.8 and full confidentiality, integrity, and availability impact, meaning a successful actor can effectively take administrative control of the affected WordPress site. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Frisbii Pay (formerly/internally named reepay-checkout-gateway) is a WooCommerce payment-gateway plugin for WordPress that integrates the Frisbii/Reepay checkout and subscription billing service into a store. The root cause is CWE-862 (Missing Authorization): one or more plugin actions - typically AJAX handlers, REST endpoints, or admin-post hooks - execute privileged operations without verifying that the calling user is authorized for them, relying only on the user being logged in. Because WordPress assigns the Contributor role minimal capabilities (drafting posts, no publishing or admin functions), an endpoint that fails to enforce a capability or nonce/role check lets a Contributor invoke functionality intended for administrators, crossing a privilege boundary within the same WordPress installation.

RemediationAI

No vendor-released patch version was identified in the provided data, so confirm the fixed release via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/reepay-checkout-gateway/vulnerability/wordpress-frisbii-pay-plugin-1-8-2-privilege-escalation-vulnerability) and upgrade the Frisbii Pay / reepay-checkout-gateway plugin to the first release above 1.8.2 once published. As compensating controls until a confirmed fixed version is installed, restrict who can hold Contributor (and other low-tier) accounts and disable open user registration or self-service contributor sign-up under Settings > General (trade-off: blocks legitimate new author onboarding); audit existing Contributor/Author accounts and remove or downgrade any that are untrusted; and place the wp-admin and admin-ajax.php/REST endpoints behind a WAF rule or IP allow-list where feasible (trade-off: may break legitimate AJAX/REST functionality for remote users). If the plugin is not actively needed, deactivating and removing it eliminates the exposure entirely at the cost of payment-gateway availability.