Frisbii Pay CVE-2026-56038

Exploitation requires an authenticated WordPress session at the Contributor role (or equivalent low-privilege level), per the explicit 'Contributor Privilege Escalation' description and the CVSS PR:L metric - it is not exploitable by fully unauthenticated attackers. The target must run the Frisbii Pay (reepay-checkout-gateway) plugin at version 1.8.2 or earlier. Limiting factors that reduce real-world risk: sites that disable open user registration or do not provision Contributor accounts to untrusted parties deny attackers the required foothold; no user interaction is needed once the account exists (UI:N), and the attack is network-reachable with low complexity, so any contributor-capable account is sufficient to trigger it.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) indicates network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with high impact across all three security properties - a serious combination. The key gating factor is PR:L: an attacker must already possess a Contributor (or equivalent low-tier) account on the target site, so this is not unauthenticated mass-exploitable; sites that do not allow open/self-service registration of contributor-level accounts face materially lower risk. No EPSS score, KEV listing, or POC was provided in the source data, so likelihood signals are limited - the absence of KEV/POC means there is no confirmed active exploitation, but Privilege Escalation flaws reported by Patchstack are frequently weaponized once a patched version ships and the diff becomes public. This is a genuine high-priority issue for any site that grants Contributor accounts to semi-trusted users (multi-author blogs, membership sites), and lower priority for single-admin sites with no untrusted low-privilege accounts.

An attacker registers or obtains a Contributor-level account on a WordPress site running Frisbii Pay <= 1.8.2 - trivial on sites that allow self-registration as contributor. They then send a crafted authenticated request to the plugin's unprotected privileged endpoint, which performs an administrative action on their behalf, escalating their effective privileges and allowing them to take over the site. No public proof-of-concept was identified at time of analysis, and exploitation requires the low-privileged account but no user interaction.