WordPress Plugin Vulnerabilities

Frisbii Pay < 1.8.3 - Missing Authorization

Description

The Frisbii Pay plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.8.2.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
reepay-checkout-gateway
Fixed in 1.8.3

References

CVE
CVE-2025-58616
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/a1825e57-b59f-4c57-8008-640717e05eb3

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Denver Jackson
Verified
No
WPVDB ID
06226381-c5d8-4738-9e76-b3041b53bbc7

Timeline

Publicly Published
2025-09-03 (about 10 months ago)
Added
2025-09-09 (about 10 months ago)
Last Updated
2025-09-09 (about 10 months ago)

Other

Published
Title
Published
2025-11-20
Title
ELEX WordPress HelpDesk & Customer Ticketing System < 3.3.2 - Missing Authorization to Authenticated (Subscriber+) Ticket Restore
Published
2026-07-08
Title
Employee, Leave and Recruitment Management System < 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Job Deletion via crewhrm_singleJobAction AJAX Action
Published
2023-02-24
Title
Apollo13 Framework Extensions < 1.9.0 - Missing Authorization
Published
2026-05-27
Title
SMTP2GO for WordPress < 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Log Read/Truncate
Published
2023-06-02
Title
WooCommerce Box Office < 1.1.52 - Unauthenticated Ticket Barcode Update