FundPress WordPress Donation Plugin CVE-2026-4650

The donate_action_status() AJAX action must be registered via wp_ajax_nopriv (which it is by default in affected versions), making it accessible to unauthenticated users without any login. The attacker must craft a POST request to wp-admin/admin-ajax.php with the action parameter set to 'donate_action_status' and provide a valid or guessable donation_id (sequential integers are enumerable). No special WordPress configuration, non-default settings, or user interaction is required - the vulnerability exists in default deployments. Exploitation is limited only by the attacker's ability to guess or enumerate active donation IDs, which is trivial given their sequential nature.

The CVSS score of 5.3 (Medium) with network vector, low complexity, and no authentication required accurately reflects the exploitability, yet the real-world risk is elevated by several factors: the vulnerability is trivially exploitable (no complex payload required, only POST parameters), affects a widely-distributed WordPress plugin, and is registered by WordPress infrastructure (wp_ajax_nopriv) to be public-facing by design. However, the impact is limited to integrity (status modification) with no confidentiality loss or availability impact on systems, and the practical harm depends on plugin configuration and whether automated email notifications are enabled. The attack requires no user interaction or special conditions beyond knowing or guessing a donation ID. No active exploitation is confirmed in the KEV list, but the vulnerability is straightforward to exploit and would require minimal reconnaissance. This is a legitimate medium-priority issue for WordPress sites running vulnerable versions, particularly those processing donations and relying on status fields for reconciliation or automated workflows.

An attacker discovers a WordPress site running FundPress 2.0.8 by inspecting plugin source or using WordPress fingerprinting tools. The attacker then iterates through likely donation IDs (starting from 1) and sends POST requests to wp-admin/admin-ajax.php with action=donate_action_status, schema=donate-ajax, and donation_id=X, setting the status parameter to 'completed' or 'cancelled'. The vulnerable AJAX handler processes each request without authentication, allowing the attacker to mark donations as processed without actual payment, potentially triggering false confirmation emails to donors and creating financial reconciliation issues for the site operator.