Description
Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions.
Published: 2026-10-29
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: Remote code execution
Action: Immediate patch
AI Analysis

Impact

A PHP Object Injection flaw exists in the Frisbii Pay WordPress plugin up to version 1.8.19, allowing an attacker to craft serialized input that is unserialized by the plugin. The vulnerability is rooted in improper handling of serialized data, categorized as CWE‑502. Exploitation can lead to execution of arbitrary code within the WordPress environment, thereby compromising the confidentiality, integrity, and availability of the site and its data.

Affected Systems

The Frisbii Pay plugin, produced by Frisbii, is affected. Any WordPress installation that has installed Frisbii Pay version 1.8.19 or earlier is vulnerable. The flaw is remedied by upgrading to 1.8.20 or later, which removes the insecure unserialization code.

Risk and Exploitability

The CVSS score of 8.8 reflects a high severity level. While the EPSS score is not available, the lack of inclusion in the CISA KEV catalog does not lessen the risk. The attack vector is inferred to be the plugin’s publicly exposed endpoints that accept serialized payloads; a crafted request would trigger the unserialize call and enable code execution on the server.

Generated by OpenCVE AI on October 29, 2026 at 17:36 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Frisbii Pay to version 1.8.20 or later to eliminate the insecure unserialization logic.
  • Configure PHP’s disable_functions directive to block unserialize if the function is not required for the site’s operations.
  • Deploy a Web Application Firewall capable of detecting and blocking suspicious serialized payload patterns targeting WordPress plugins.

Generated by OpenCVE AI on October 29, 2026 at 17:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions.
Title WordPress Frisbii Pay plugin <= 1.8.19 - PHP Object Injection vulnerability
Weaknesses CWE-502
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-29T15:24:35.032Z

Reserved: 2026-10-27T16:00:44.817Z

Link: CVE-2026-118076

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-29T16:18:02.297

Modified: 2026-10-29T16:20:19.663

Link: CVE-2026-118076

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-29T17:45:17Z

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data