Frisbii Pay WordPress plugin: PHP Object Injection via Contributor role
Summary
The Frisbii Pay WordPress plugin (WooCommerce payment gateway) up to and including version 1.8.19 is affected by a PHP Object Injection vulnerability (CWE-502). An authenticated user with Contributor privileges can send crafted data that the plugin deserializes, which can lead to manipulation of server-side processing and, depending on the site, to code execution, data access or data changes. Exploitation requires a low-privileged account and is not known to be actively exploited.
Affected
- Frisbii Pay WordPress plugin (slug reepay-checkout-gateway), versions up to and including 1.8.19
- Required privilege: Contributor
Fixed in
- Patched version reported by Patchstack: 1.8.20 or later
- Fixed version not confirmed by the vendor; WordPress.org listing seen during research showed 1.8.19 as current
Workaround
- Unknown. No vendor workaround found.
- Disable the plugin if it is not needed.
- Review and restrict accounts with Contributor or higher roles.
Exploitation
- No known exploitation (KEV: No, per OffSeq and Strix).
- VulDB states no exploit is available.
- EPSS: 0.37 % (percentile 31).
- CISA SSVC: Exploitation none, Automatable no, Technical impact total.
Our recommendation
- Check whether the Frisbii Pay plugin is installed and which version is active.
- Update to 1.8.20 or later as soon as it is available on WordPress.org; re-check the Patchstack page for the current fixed version.
- Until a fix is confirmed, review Contributor and higher accounts and remove unneeded ones.
- Monitor the plugin and web server logs for unusual requests to the checkout and plugin endpoints.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- WordPress.org plugin listing wordpress.org
- VulDB entry 428505 vuldb.com
- Strix CVE record www.strix.ai
- OffSeq threat radar radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:06.
Original description (NVD)
Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.