CVE-2026-56038: Frisbii Pay Privilege Escalation Flaw

CVE-2026-56038 Overview

CVE-2026-56038 is a privilege escalation vulnerability in the Frisbii Pay WordPress plugin (also tracked as the Reepay Checkout Gateway plugin) in versions up to and including 1.8.2. The flaw is classified under CWE-862: Missing Authorization, allowing an authenticated user with Contributor-level access to elevate privileges beyond their intended role. Successful exploitation compromises confidentiality, integrity, and availability of affected WordPress sites. The vulnerability was published on 2026-06-26 and last updated on 2026-06-26.

Critical Impact
A Contributor-level account can escalate privileges on a WordPress site running Frisbii Pay 1.8.2 or earlier, enabling full site takeover through unauthorized administrative actions.

Affected Products

Frisbii Pay WordPress plugin versions 1.8.2 and earlier
Reepay Checkout Gateway plugin (same codebase) versions 1.8.2 and earlier
WordPress sites accepting user registration at Contributor level or higher

Discovery Timeline

2026-06-26 - CVE-2026-56038 published to the National Vulnerability Database
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-56038

Vulnerability Analysis

CVE-2026-56038 is a Broken Access Control flaw in the Frisbii Pay plugin, mapped to CWE-862 Missing Authorization. The plugin exposes one or more actions that do not verify whether the calling user holds the required capability. A logged-in Contributor can invoke these actions and perform operations reserved for higher-privileged roles.

The vulnerability requires authentication but no user interaction. Attackers exploit it over the network against the WordPress AJAX or REST surface exposed by the plugin. Because Contributor accounts are commonly granted on multi-author sites, the attacker prerequisite is low.

Successful exploitation yields full compromise of the site. An escalated account can install malicious plugins, modify content, exfiltrate customer and payment metadata handled by the checkout gateway, or pivot to hosting infrastructure. See the Patchstack WordPress Vulnerability Report for the underlying advisory.

Root Cause

The root cause is a missing capability check on a privileged plugin handler. The plugin authenticates the request through WordPress session handling but does not call current_user_can() with an appropriate capability or verify a matching nonce scope before executing the sensitive action. This is a textbook [CWE-862] pattern in WordPress plugins.

Attack Vector

The attack vector is network-based against the WordPress HTTP endpoints registered by the Frisbii Pay plugin. An authenticated Contributor sends a crafted request to the vulnerable handler and receives an elevated result, such as writing to protected options, creating administrator accounts, or executing privileged plugin workflows. No social engineering or victim interaction is required.

No public proof-of-concept, ExploitDB entry, or CISA KEV listing is available at publication. The EPSS score is 0.232% (percentile 13.98) as of 2026-07-02, indicating low predicted near-term exploitation, though this can change once details are widely reproduced.

Detection Methods for CVE-2026-56038

Indicators of Compromise

Unexpected creation of administrator or editor accounts on sites running Frisbii Pay or Reepay Checkout Gateway 1.8.2 or earlier.
Unauthorized changes to WordPress options, active plugins, or theme files initiated by Contributor-role accounts.
Plugin-specific AJAX or REST endpoint requests originating from low-privileged user sessions in web server access logs.

Detection Strategies

Audit the wp_users and wp_usermeta tables for recent role changes, especially Contributors upgraded to Editor or Administrator.
Review web server and WordPress audit logs for requests to Frisbii Pay or Reepay plugin action handlers from non-admin sessions.
Inventory installed plugin versions across managed WordPress estates and flag any instance of Frisbii Pay or Reepay Checkout Gateway at version 1.8.2 or below.

Monitoring Recommendations

Enable WordPress security logging plugins to capture role changes, plugin installations, and option updates in real time.
Alert on HTTP POST requests to /wp-admin/admin-ajax.php and REST namespaces used by the plugin when the authenticated user role is Contributor.
Forward WordPress and web server logs to a centralized analytics platform for correlation of authentication, role change, and file modification events.

How to Mitigate CVE-2026-56038

Immediate Actions Required

Update the Frisbii Pay or Reepay Checkout Gateway plugin to a version later than 1.8.2 as soon as the vendor releases a fix confirmed in the Patchstack advisory.
Review all Contributor, Author, and Editor accounts and remove or reset any that are unused or unverified.
Rotate WordPress administrator passwords and invalidate active sessions if the plugin has been installed in a version at or below 1.8.2.

Patch Information

Refer to the Patchstack WordPress Vulnerability Report for vendor patch status and fixed version details. Apply the patched release through the WordPress plugin updater once available and confirm the installed version afterward.

Workarounds

Deactivate the Frisbii Pay or Reepay Checkout Gateway plugin until a patched version is installed if the checkout functionality is not business-critical.
Restrict Contributor account creation and disable open user registration for the affected sites.
Deploy a Web Application Firewall (WAF) rule to block requests from non-administrator sessions targeting the plugin's action handlers.

bash

# Identify vulnerable plugin installations via WP-CLI
wp plugin list --name=reepay-checkout-gateway --fields=name,status,version
wp plugin list --name=frisbii-pay --fields=name,status,version

# Deactivate the plugin as a temporary workaround
wp plugin deactivate reepay-checkout-gateway
wp plugin deactivate frisbii-pay

# Audit users elevated above Contributor within the last 30 days
wp user list --role=administrator --fields=ID,user_login,user_registered
wp user list --role=editor --fields=ID,user_login,user_registered