Frisbii Pay WordPress plugin: PHP Object Injection via Contributor role
The Frisbii Pay WordPress plugin (WooCommerce payment gateway) up to and including version 1.8.19 is affected by a PHP Object Injection vulnerability (CWE-502). An authenticated user with Contributor privileges can send crafted data that the plugin deserializes, which can lead to manipulation of server-side processing and, depending on the site, to code execution, data access or data changes. Exploitation requires a low-privileged account and is not known to be actively exploited.
Frisbii · Frisbii Pay
