CVE-2026-118076

HighCVSS 8.8

Published: 29/10/2026(UTC)Updated: 29/10/2026(UTC)Translated: 29/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

31th percentile - higher than 31% of all known CVEs

Summary

The Frisbii Pay plugin in versions up to and including 1.8.19 contains a PHP Object Injection vulnerability exploitable by a user with Contributor privileges. The flaw allows injection of a malicious PHP object, potentially leading to further attacks depending on available classes in the codebase.

Risk Assessment

A Contributor-level user could exploit this to escalate privileges or perform unauthorized operations within the WordPress context. This may compromise data security and site integrity.

Recommendation

Update the Frisbii Pay plugin to a version later than 1.8.19 that fixes the vulnerability. Until then, limit the number of accounts with Contributor privileges.

Other vulnerabilities in Frisbii Pay

CVE-2026-3462Medium
The Frisbii Pay plugin for WordPress is vulnerable to unauthorized data modification due to missing capability checks in the 'upload_csv' and 'process_batch' functions in all versions up to and including 1.8.9. This allows authenticated attackers with Subscriber-level access and above to upload arbitrary CSV data and overwrite WooCommerce payment tokens, postmeta, and order meta records.

Original NVD description (English source)

Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS