EUVD-2026-57080
GHSA-j969-3gcr-g846
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network AJAX vector, low complexity; PR:L reflects required Subscriber account; integrity-only impact from unauthorized post creation.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts despite not being granted that permission.
AnalysisAI
WP Crowdfunding WordPress plugin before version 2.2.1 allows any subscriber-level authenticated user to create crowdfunding campaign posts by exploiting a missing capability check in an AJAX action endpoint. The plugin fails to verify whether the requesting user holds the campaign-submission permission, allowing low-privilege WordPress roles to perform actions reserved for higher-privileged users. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress account with at minimum Subscriber-level privileges - the lowest authenticated role. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N correctly characterizes this as a low-complexity, network-accessible flaw requiring only a low-privilege account. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a free Subscriber account on a target WordPress site (or reuses compromised credentials), then sends a crafted AJAX POST request directly to the wp-admin/admin-ajax.php endpoint targeting the vulnerable action, bypassing the campaign-submission permission check. Because the capability gate is missing, the server processes the request and creates a published crowdfunding campaign post under the attacker's account. … |
| Remediation | Update the WP Crowdfunding plugin to version 2.2.1 or later, which introduces the missing capability check in the affected AJAX action. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Crowdfunding
View allInsecure Direct Object Reference in WP Crowdfunding (WordPress plugin, all versions before 2.2.1) allows any authenticat
Broken object-level authorization in the WP Crowdfunding WordPress plugin before 2.2.1 allows any authenticated user - i
The WP Crowdfunding WordPress plugin before 2.1.9 does not sanitise and escape a parameter before outputting it back in
The WP Crowdfunding WordPress plugin before 2.1.8 does not sanitise and escape some of its settings, which could allow h
Insecure Direct Object References in WP Crowdfunding (Themeum) versions prior to 2.2.1 allow authenticated subscriber-le
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum WP Crowdfu
The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wp-crowdfunding/search blo
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcf_donate short
The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability c
Missing Authorization vulnerability in Themeum WP Crowdfunding allows Exploiting Incorrectly Configured Access Control S
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today