What is the CVSS score of CVE-2026-32470?

CVE-2026-32470 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of FundEngine are affected by CVE-2026-32470?

The FundEngine WordPress fundraising plugin (versions through 1.7.9) contains a critical unauthenticated remote code execution vulnerability that allows attackers to compromise WordPress sites and…

How to fix or mitigate CVE-2026-32470?

Within 24 hours, identify all WordPress instances running FundEngine and immediately deactivate the plugin, or implement temporary access controls to restrict its use to authenticated administrators only. Within 7 days, migrate to an alternative, security-vetted fundraising solution and deploy Web Application Firewall (WAF) rules blocking PHP serialization attacks if temporary controls are still in place. Within 30 days, complete the migration, audit affected systems for compromise indicators (unauthorized admin accounts, database changes, suspicious files), and implement ongoing vulnerability scanning for fundraising plugins.

FundEngine CVE-2026-32470

EUVD-2026-60905 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-08-18 Patchstack

GHSA-r9gq-24g4-hqqg

PHP WordPress Deserialization Wordpress Plugin Fundengine Roxnor

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated remote deserialization sink reachable with no user interaction (AV:N/AC:L/PR:N/UI:N); object injection to RCE-class gadgets justifies full C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 15:23 vuln.today

CVE Published

Aug 18, 2026 - 13:59 cve.org

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.

Articles & Coverage 1

News Critical PHP Object Injection in FundEngine WordPress Plugin - CVE-2026-32470 Aug 19, 2026

AnalysisAI

Unauthenticated PHP Object Injection in the FundEngine WordPress fundraising/donation plugin (slug wp-fundraising-donation) affects all versions up to and including 1.7.9, letting a remote attacker with no authentication inject a crafted serialized PHP object into an application deserialization sink. Given the CWE-502 root cause and the PR:N/UI:N vector, a successful attack can pivot to remote code execution, data theft, or full site takeover when a suitable POP gadget chain is reachable. Reported by Patchstack and rated CVSS 9.8, with no public exploit identified at time of analysis and no CISA KEV listing.

Technical ContextAI

The affected component is FundEngine (vendor roxnor), a WordPress plugin distributed under the slug wp-fundraising-donation that handles online fundraising and donation workflows; CPE cpe:2.3:a:roxnor:fundengine confirms the product identity. The vulnerability class is CWE-502 (Deserialization of Untrusted Data): the plugin passes attacker-controllable input into a PHP deserialization routine (typically unserialize()) without restricting the object types produced. When PHP reconstructs an attacker-defined object, magic methods such as __wakeup(), __destruct(), or __toString() fire automatically; chaining these across classes present in WordPress core, the plugin, or other active plugins (a POP / property-oriented-programming gadget chain) is what turns object injection into concrete impact like file writes, SQL manipulation, or code execution. The 'PHP', 'Deserialization', and 'Fundengine' tags reinforce that this is a classic object-injection sink rather than a memory-safety bug.

RemediationAI

No specific fixed version is provided in the supplied intelligence, so treat patch status as: no vendor-released fixed version independently confirmed at time of analysis - consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wp-fundraising-donation/vulnerability/wordpress-fundengine-plugin-1-7-9-php-object-injection-vulnerability?_s_id=cve) and the WordPress plugin page for a release above 1.7.9 and upgrade as soon as one is confirmed. Until a patched release exists, the strongest compensating control is to deactivate and remove the wp-fundraising-donation plugin, which stops donation processing but eliminates the vulnerable sink; if it must remain active, deploy a WAF or virtual patch (Patchstack virtual patching or an equivalent ruleset) to block requests containing PHP serialization markers (e.g. O:, a:, __PHP_Incomplete_Class) reaching the plugin's endpoints, accepting that WAF rules can be bypassed and may false-positive on legitimate serialized data. Additionally restrict access to the affected AJAX/REST endpoints and monitor logs for anomalous POST payloads.