CVE-2026-3462 is a missing authorization vulnerability (CWE-862) in the Frisbii Pay WordPress plugin by reepaydenmark. The issue arises because the plugin fails to perform proper capability checks on the 'upload_csv' and 'process_batch' functions. As a result, authenticated users with low privileges (Subscriber and above) can upload arbitrary CSV data that overwrites sensitive WooCommerce payment tokens and metadata. This vulnerability affects all versions up to and including 1.8.9. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required. There is no official patch or remediation level indicated, and no known exploits in the wild have been reported.

An attacker with Subscriber-level access or higher can modify critical WooCommerce payment and order data by uploading crafted CSV files. This compromises the integrity of payment tokens and order metadata, potentially leading to unauthorized payment manipulation or disruption of order processing. Confidentiality and availability are not impacted according to the CVSS vector, but integrity is fully compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted individuals only and monitor for suspicious activity related to CSV uploads. Avoid granting Subscriber or higher privileges to untrusted users. Follow vendor updates closely for any released patches or official mitigations.