CVE-2026-3462 Overview
CVE-2026-3462 is a missing authorization vulnerability [CWE-862] in the Frisbii Pay plugin for WordPress. The flaw affects all versions up to and including 1.8.9. The plugin fails to enforce capability checks on the upload_csv and process_batch functions. Authenticated attackers with Subscriber-level access or above can upload arbitrary CSV data and overwrite WooCommerce payment tokens, postmeta, and order meta records. The vulnerability is tracked under the plugin slug reepay-checkout-gateway.
Critical Impact
Any authenticated user, including low-privilege Subscribers, can tamper with WooCommerce payment tokens and order metadata, enabling fraud, order manipulation, and integrity loss across e-commerce data.
Affected Products
- Frisbii Pay plugin for WordPress (reepay-checkout-gateway)
- All versions up to and including 1.8.9
- Installations running WooCommerce with the Frisbii Pay integration
Discovery Timeline
- 2026-06-27 - CVE-2026-3462 published to NVD
- 2026-06-29 - Last updated in NVD database
Technical Details for CVE-2026-3462
Vulnerability Analysis
The Frisbii Pay plugin exposes administrative migration endpoints without proper capability enforcement. The upload_csv and process_batch functions in includes/Admin/MigrationMobilepayToVipps.php handle CSV imports intended for migrating payment tokens from MobilePay to Vipps. Because the plugin does not verify the caller's WordPress capability, any authenticated session, including a Subscriber account, can invoke these actions. The plugin then writes attacker-supplied CSV records into WooCommerce data structures, overwriting payment tokens, postmeta, and order meta rows.
The integrity impact is high because the affected records govern how WooCommerce associates payment methods and stored gateway identifiers with customer orders. Confidentiality and availability are not directly affected, but downstream fraud and reconciliation errors are plausible outcomes.
Root Cause
The root cause is a missing authorization check [CWE-862]. The handlers registered for the CSV upload and batch processing flows lack calls to current_user_can() for an administrative capability such as manage_woocommerce or manage_options. Nonce verification alone, if present, does not restrict which authenticated roles can trigger the endpoint.
Attack Vector
An attacker registers or authenticates as any WordPress user with at least Subscriber privileges. The attacker then issues a request to the plugin's admin-ajax or admin-post handler that dispatches upload_csv, followed by process_batch. The submitted CSV payload contains crafted rows that map to existing WooCommerce token IDs, postmeta keys, or order meta keys. On processing, the plugin overwrites the targeted records with attacker-controlled values. See the WordPress Plugin Code Snippet at line 42, line 129, and line 170 for the affected handler locations.
Detection Methods for CVE-2026-3462
Indicators of Compromise
- Unexpected requests from low-privilege user sessions targeting Frisbii Pay admin endpoints, particularly parameters referencing upload_csv or process_batch.
- Modified rows in the woocommerce_payment_tokens and woocommerce_payment_tokenmeta tables that do not correspond to legitimate customer activity.
- New or altered records in wp_postmeta and order meta associated with WooCommerce orders outside of normal checkout flows.
- CSV file uploads landing in plugin upload directories without a corresponding administrator-initiated migration event.
Detection Strategies
- Enable WordPress and WooCommerce audit logging to capture the acting user ID and role for every plugin admin action.
- Alert when accounts with the Subscriber, Customer, or Contributor role invoke admin-ajax or admin-post actions belonging to reepay-checkout-gateway.
- Compare payment token and order meta snapshots on a rolling basis to detect bulk overwrites consistent with CSV import behavior.
Monitoring Recommendations
- Forward WordPress access logs and WooCommerce database change events to a centralized SIEM for correlation.
- Monitor HTTP request bodies for multipart/form-data uploads containing CSV payloads targeting Frisbii Pay endpoints.
- Track authentication events for newly created low-privilege accounts followed by immediate plugin endpoint access.
How to Mitigate CVE-2026-3462
Immediate Actions Required
- Update the Frisbii Pay plugin to a version above 1.8.9 that includes the fix from WordPress Changeset #3485246.
- Audit WooCommerce payment tokens, postmeta, and order meta for unauthorized modifications since the plugin was installed.
- Review all WordPress accounts and disable or remove any unexpected Subscriber-level users.
Patch Information
The vendor addressed the missing capability checks in the plugin repository under changeset 3485246. Site owners should upgrade to the patched release through the WordPress plugin updater. Full details are available in the Wordfence Vulnerability Report.
Workarounds
- Disable the Frisbii Pay plugin until the patched version is deployed if immediate updates are not possible.
- Restrict access to wp-admin/admin-ajax.php and wp-admin/admin-post.php at the web application firewall for non-administrator roles.
- Temporarily disable open user registration to reduce the pool of accounts capable of exploiting the flaw.
- Rotate WooCommerce API keys and re-validate stored payment tokens after confirming remediation.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
