What is the CVSS score of CVE-2026-57406?

CVE-2026-57406 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.3%.

FundEngine CVE-2026-57406

EUVD-2026-43479 MEDIUM

Missing Authorization (CWE-862)

2026-07-13 Patchstack

WordPress Authentication Bypass Wordpress Plugin Fundengine Roxnor

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Network vector and no-auth access confirmed by CWE-862 with Authentication Bypass tag; limited I:L/A:L impact with no confidentiality breach matches plugin-scoped missing authorization.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:25 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in Roxnor FundEngine wp-fundraising-donation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FundEngine: from n/a through <= 1.7.6.

AnalysisAI

Missing authorization in the FundEngine WordPress fundraising plugin (versions through 1.7.6) permits unauthenticated remote attackers to exploit incorrectly configured access control, resulting in partial data integrity and availability impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity, unauthenticated network exploitation with no user interaction required. No active exploitation is confirmed in the CISA KEV catalog, and no public exploit code has been identified at the time of this analysis.

Technical ContextAI

CWE-862 (Missing Authorization) describes a failure to verify that a requesting party holds sufficient privileges before executing a sensitive operation. In WordPress plugin context, this typically manifests as REST API endpoints or AJAX handlers that perform privileged actions without capability checks via functions like current_user_can(). The affected product is the Roxnor FundEngine plugin (CPE: cpe:2.3:a:roxnor:fundengine:*:*:*:*:*:*:*:*), a WordPress donation and fundraising plugin. The 'Authentication Bypass' tag from Patchstack indicates that specific plugin functionality is reachable without logging in, which is consistent with the PR:N metric in the provided CVSS vector. Scope is unchanged (S:U), meaning exploitation is contained within the plugin's own security context and does not directly pivot to WordPress core or the underlying server.

RemediationAI

Update the FundEngine plugin to a version beyond 1.7.6 once a patched release becomes available from Roxnor. The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/wp-fundraising-donation/vulnerability/wordpress-fundengine-plugin-1-7-6-broken-access-control-vulnerability) should be monitored for a confirmed fixed version, which has not been independently verified in the available data. If immediate patching is not possible, consider restricting access to the WordPress site's AJAX and REST API endpoints at the web server or WAF layer for unauthenticated traffic as a compensating control - note this may break legitimate donor-facing functionality and should be tested before deployment. WordPress site owners should also review the plugin's registered AJAX actions and REST routes to identify and temporarily disable any that do not require authentication.