Wordpress Plugin CVE-2026-59560

We need to parse the input and produce a JSON. Let's extract all provided data:

CVE ID: CVE-2026-59560 Description: "Subscriber Broken Access Control in FundEngine <= 1.7.8 versions." That's all. Very sparse. CVSS Score: 6.5 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CWE: CWE-862 (Missing Authorization)

Multi-source intelligence: Reported by: Patchstack CPE: cpe:2.3:a:roxnor:fundengine:*:*:*:*:*:*:*:* (implies version <=1.7.8 from affected versions) Tags: Authentication Bypass, Fundengine (tags from probably Patchstack) ENISA EUVD ID: EUVD-2026-49227 Affected versions (EUVD): ["FundEngine n/a ≤1.7.8"] - note the "n/a" maybe they say version up to 1.7.8. References: [cveorg] (None) but URL: https://patchstack.com/database/wordpress/plugin/wp-fundraising-donation/vulnerability/wordpress-fundengine-plugin-1-7-8-broken-access-control-vulnerability?_s_id=cve

We have no EPSS, no KEV status, no POC availability explicitly in the data. So we'll assume none provided. However, we must synthesize. The vulnerability is "Subscriber Broken Access Control", CWE-862 Missing Authorization. CVSS: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H -> high availability impact, no confidentiality/integrity. So an authenticated subscriber (low privilege) can cause a denial of service. The product is FundEngine, a WordPress plugin for fundraising/donation. So likely a WordPress plugin. Vendor: roxnor. The reference leads to Patchstack database. Patchstack often lists these. We need to infer from the URL: "wordpress-fundengine-plugin-1-7-8-broken-access-control-vulnerability". So it's in the wp-fundraising-donation plugin. The product name: FundEngine. So product_name: "FundEngine" (WordPress plugin).

The description is "Subscriber Broken Access Control in FundEngine <= 1.7.8 versions." We need to write summary: original synthesis, not paraphrasing description. So what can a low-privileged subscriber do? They can cause a denial of service (from CVSS A:H). The description says broken