EUVD-2026-63312
GHSA-6gfw-w2xm-f74r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running FundEngine <= 1.7.9
-
DeliverySend crafted serialized PHP object in request
-
ExploitTrigger unserialize() in plugin
-
ExecutionInstantiate gadget chain objects
-
ImpactExecute code or manipulate data as web user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that untrusted input reach the plugin's deserialization sink, which per the CVSS vector (AV:N/AC:L/PR:N/UI:N) needs no authentication, no user interaction, and only network access to a site running FundEngine <= 1.7.9 - so any internet-facing WordPress install with the plugin active is reachable. The key limiting factor is that PHP object injection is only impactful when an exploitable POP gadget chain exists in the loaded PHP code (plugin, WordPress core, or another plugin/theme); without a usable chain the injection may cause no material harm. Exploitation is further bounded to installations actually running the vulnerable plugin at version 1.7.9 or below. |
| Impact | The CVSS 3.1 score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting network-reachable, low-complexity, unauthenticated exploitation with high confidentiality, integrity, and availability impact - the maximal profile for a WordPress plugin flaw. Counterbalancing signals temper this: there is no KEV listing, no EPSS score supplied, and no evidence of a public POC, so exploitation is theoretical rather than demonstrated. The practical severity of PHP object injection also hinges on the availability of a usable POP gadget chain in the target environment; where none exists, real impact may fall well short of full RCE. Net assessment: treat as high priority for remediation given unauthenticated network reach, but note that the 9.8 represents worst-case potential and no active-exploitation or EPSS data was provided to confirm widespread real-world risk. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to a FundEngine plugin endpoint with a serialized PHP object string embedded in a parameter the plugin later deserializes. When the plugin calls unserialize(), a gadget chain in the WordPress stack executes, allowing the attacker to read or write files, run code, or corrupt data. No public POC is currently known, so exploitation would require the attacker to identify a viable gadget chain in the target's installed plugins/themes. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 20, 2026
Unauthenticated PHP object injection in the Roxnor FundEngine (wp-fundraising-donation) WordPress plugin through version 1.7.9 lets remote attackers pass attacker-controlled serialized data into a PHP unserialize() sink without authentication. If a suitable POP gadget chain is present in the plugin, WordPress core, or another installed plugin, this can escalate to arbitrary code execution, file operations, or SQL manipulation. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
RemediationAI
No vendor-released patch version was identified in the provided data; the fix version is not stated in the Patchstack advisory reference supplied. Administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wp-fundraising-donation/vulnerability/wordpress-fundengine-plugin-1-7-9-php-object-injection-vulnerability-2) and upgrade to the first release above 1.7.9 as soon as the vendor publishes it. Until a patched build is confirmed and installed, reduce exposure by disabling or removing the FundEngine plugin if the donation functionality is non-essential (trade-off: fundraising forms go offline), or by placing a WAF/virtual patch rule (such as Patchstack's) in front of the affected endpoints to block serialized-object payloads (trade-off: possible false positives on legitimate form data). Restricting network access to the plugin's request handlers and monitoring for serialized-object markers (e.g., 'O:' patterns) in request bodies provides additional interim defense.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
FundEngine is a WordPress fundraising/donation plugin (vendor 'roxnor', slug 'wp-fundraising-donation'). The flaw is CWE-502 (Deserialization of Untrusted Data): the plugin passes untrusted input to PHP's unserialize() or an equivalent object-instantiation path. When PHP deserializes attacker-crafted data, it reconstructs objects whose magic methods (__wakeup, __destruct, __toString) fire automatically; by chaining such 'gadgets' present in loaded code, an attacker can drive unintended behavior. Per the CPE cpe:2.3:a:roxnor:fundengine:*, all versions up to and including 1.7.9 are affected. PHP object injection has no impact on its own unless an exploitable gadget chain exists in the runtime, which is why real-world impact varies by the specific WordPress stack.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable deserialization sink (PR:N, AV:N, AC:L) with potential for code execution and data compromise gives high C/I/A, matching the reported vector.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.
Articles & Coverage 1
Executive ViewAI
The Roxnor FundEngine WordPress donation plugin (versions through 1.7.9) contains a critical vulnerability allowing remote attackers to take complete control of affected websites and access sensitive donor data without authentication; no public exploit identified at time of analysis. With no vendor patch currently available, all installations face immediate risk of compromise. Organizations using this plugin must implement urgent mitigation to protect their fundraising operations and donor information.
No vendor-released patch identified at time of analysis. Implement compensating controls: deploy Web Application Firewall rules to block PHP serialization payloads and malicious requests to plugin endpoints; disable the plugin if an alternative donation mechanism is available; apply network-level access restrictions limiting exposure to trusted networks; enable intrusion detection and prevention for exploit attempts; maintain comprehensive audit logging of all plugin activity; conduct immediate vulnerability scans of the WordPress installation; prepare incident response procedures.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB