Crowdfundly CVE-2026-85126

Exploitation requires the attacker to already hold one of Crowdfundly's own low-privileged roles, so the plugin must be installed and the attacker must be able to obtain such an account - typically trivial on sites that allow open self-registration of backers/campaigners, but a hard limiter on sites that restrict account creation. The flaw is reachable remotely over the network against default installs (missing capability checks on specific AJAX actions), needs no victim interaction, and affects all versions through 2.2.2. The key limiting factor is the authenticated low-privilege foothold; sites without public registration or without the plugin are not exposed.

This is a genuine authenticated privilege-escalation flaw (CWE-269) in which missing capability checks on Crowdfundly AJAX actions let an attacker holding a low-privileged plugin role elevate to administrator, resulting in full site takeover. The provided CVSS:3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2) describes a low-complexity network-reachable attack with full CIA impact, which is the dominant risk signal. A publicly available exploit (WPScan) raises real-world exploitability above a theoretical issue. CONFLICTING SIGNAL: the CVSS vector encodes PR:H (high privileges required), but the description explicitly states the attacker only needs 'one of its own low privileged roles' - this points to PR:L, not PR:H, which would raise the true base score to ~8.8; the input vector appears to understate attacker reach. No EPSS score and no KEV listing were provided, so there is no evidence of mass automated or confirmed active exploitation yet; the presence of public exploit code combined with the self-registration dynamics common to crowdfunding sites nonetheless makes this a credible priority wherever the plugin is installed and low-privilege account creation is open.

An attacker who already holds a low-privileged Crowdfundly role (e.g. a self-registered campaigner/backer account on a crowdfunding site) sends a crafted request to one of the plugin's unprotected AJAX actions. Because the action lacks a capability check, the attacker assigns themselves the administrator role or arbitrary capabilities and takes over the entire WordPress site. Public exploit code for this technique is available via WPScan, lowering the skill required.