CVE-2026-3462 describes a missing authorization vulnerability in the Frisbii Pay WordPress plugin (versions <=1.8.9). The plugin's 'upload_csv' and 'process_batch' functions lack proper capability checks, allowing authenticated users with minimal privileges (Subscriber and above) to upload arbitrary CSV files. This unauthorized action enables overwriting of WooCommerce payment tokens and metadata associated with orders, potentially compromising payment data integrity. The vulnerability does not impact confidentiality or availability but has a significant impact on data integrity.

Exploitation allows authenticated users with Subscriber-level access or higher to modify critical WooCommerce payment-related data, including payment tokens and order metadata. This can lead to unauthorized changes in payment processing data, potentially disrupting transaction integrity and causing financial discrepancies. There is no indication of impact on confidentiality or availability.

No official patch or fix has been confirmed or published as of the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles and permissions to trusted users only and monitor for suspicious activity related to CSV uploads and order modifications. Avoid granting Subscriber-level or higher access to untrusted users.