FundEngine CVE-2026-57406

No authentication is required - the CVSS PR:N metric confirms unauthenticated network exploitation. No user interaction is needed (UI:N). Attack complexity is low (AC:L), indicating no special race conditions or non-default configuration states are required. The limiting factor is that the affected product must be the FundEngine plugin (wp-fundraising-donation) installed and active on a WordPress site, running version 1.7.6 or earlier. Impact is bounded to partial integrity and availability within the plugin's scope; confidentiality is unaffected (C:N), meaning attacker cannot read sensitive donor or payment data through this vector alone.

The CVSS base score of 6.5 (Medium) reflects network-accessible, unauthenticated exploitation with limited impact - integrity loss (I:L) and availability disruption (A:L) but no confidentiality breach (C:N). The AC:L metric confirms low exploitation complexity, requiring no race conditions or specialized configuration. No EPSS data was supplied, preventing probabilistic exploitation-likelihood assessment. The absence of a CISA KEV entry and any identified public exploit code suggests this is not currently under active widespread attack. However, the PR:N metric is a meaningful risk amplifier: any internet-facing WordPress installation running FundEngine ≤1.7.6 is technically reachable without credentials. Real-world risk is moderate and primarily relevant to organizations hosting donation campaigns where tampered fundraising records or disrupted availability could have financial or reputational consequences. The limited impact scope (no data exfiltration) reduces urgency somewhat compared to a full-compromise flaw.

An unauthenticated attacker identifies a WordPress site running FundEngine ≤1.7.6 and sends crafted HTTP POST or GET requests to the plugin's exposed AJAX or REST API endpoints, bypassing the absent authorization checks. With no credentials or user interaction required, the attacker manipulates fundraising records or disrupts plugin availability, potentially undermining donor trust or corrupting campaign data. No public exploit code has been identified, but the low attack complexity makes manual exploitation straightforward for any attacker familiar with WordPress plugin internals.