CVE-2026-118076

Name of the Vulnerable Software and Affected Versions Frisbii Pay versions prior to 1.8.20

Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. Authenticated attackers with contributor-level access or higher can inject a PHP Object. While no POP chain (a sequence of gadgets used to achieve code execution) is present in the software itself, the presence of a POP chain via other installed plugins or themes could allow an attacker to execute code, retrieve sensitive data, or delete arbitrary files.

Recommendations Update Frisbii Pay to a version newer than 1.8.19.