FundEngine CVE-2026-75930

Exploitation requires an authenticated WordPress account at subscriber level or above - the attacker must either leverage open user registration (enabled under Settings → General → Membership) or have obtained valid credentials by other means. The vulnerable handler in apps/content.php at lines approximately 289, 1195, and 1228 in version 1.8.1 accepts arbitrary post_id and post_author values without performing per-resource authorization checks on the authenticated caller. The wp_rest nonce is required by the handler but is trivially obtainable by any authenticated user via /wp-admin/admin-ajax.php?action=rest-nonce and therefore does not constitute an authorization barrier. Exploitation is bounded by two conditions: the FundEngine plugin must be installed and active, and the attacker must possess at minimum a subscriber-level authenticated session. Sites that disable open registration and restrict credentials to trusted individuals significantly reduce external attack surface, though insider or compromised-account risk remains regardless of registration settings.

The NVD CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, score 4.3) reflects a low-complexity network attack requiring only subscriber-level authentication with no user interaction needed. The integrity impact is rated Low by NVD, but the practical impact is arguably understated: the attacker can deface any post or page site-wide and transfer ownership of fundraising campaign pages to attacker-controlled accounts, which could directly facilitate donor fraud on live campaigns. No EPSS data was provided in the available intelligence, and no KEV listing exists, indicating no confirmed widespread exploitation at the time of this analysis. However, the trivially bypassable nonce removes the one apparent friction point, meaning exploitation effort is minimal for any authenticated user. Even a mid-sized nonprofit web team in sopot running an open-registration WordPress installation should prioritize this fix over higher-CVSS findings that require more complex exploitation chains, because the low barrier compounds the integrity risk. Sites with public subscriber registration face the greatest exposure; those with tightly controlled user accounts are significantly less exposed to external attackers.

An attacker self-registers as a subscriber on a WordPress site running FundEngine 1.8.1 or earlier, then calls /wp-admin/admin-ajax.php?action=rest-nonce to obtain a valid wp_rest nonce with no elevated privileges required. Using that nonce, the attacker submits a crafted request to the vulnerable handler in content.php, specifying an arbitrary target post ID and an attacker-controlled post_author integer, thereby overwriting a live fundraising campaign page's content and transferring its ownership to a fraudulent account - potentially redirecting donor activity.