CVE-2026-118076: WordPress Frisbii Pay plugin <= 1.8.19 - PHP Object Injection vulnerability
Published Oct 29, 2026
·Updated
Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions.
Event History
Oct 29, 2026
CVE Published
via MITRE·03:24 PM
Data Sourced
via MITRE·03:24 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker needs Contributor-level access to a WordPress site using an affected Frisbii Pay version. No user interaction is required after the attacker has that level of access.
2
What impact could successful exploitation have?
The reported CVSS vector indicates high potential impact to confidentiality, integrity, and availability. The issue is categorized as PHP object injection.