CVE-2026-3462

Name of the Vulnerable Software and Affected Versions Frisbii Pay versions prior to 1.9.0

Description Authenticated users with Subscriber-level access and above can perform unauthorized modification of data. This is caused by missing capability checks in the upload csv() and process batch() functions. An attacker can exploit this to upload arbitrary CSV data and overwrite WooCommerce payment tokens, postmeta, and order meta records.

Recommendations Update the plugin to version 1.9.0 or later. As a temporary workaround, restrict access to the upload csv() and process batch() functions.