EUVD-2026-49227
GHSA-7rhf-gp2p-72j6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister or obtain Subscriber account
-
ExploitSend request to unprotected plugin action
-
ExecutionMissing authorization check bypassed
-
ImpactDisrupt fundraising availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress session at Subscriber level (PR:L) on a site running FundEngine (plugin slug wp-fundraising-donation) version <= 1.7.8; the attacker must reach a plugin action/endpoint that omits its capability or nonce authorization check (CWE-862 missing authorization). Limiting factors: the site must allow the attacker to hold a low-privilege account - practical only where open user registration is enabled or the attacker already has a Subscriber login; impact is confined to availability of the plugin's fundraising functionality (no data disclosure or modification), and no unauthenticated path is indicated. |
| Impact | Multiple signals converge on this being a genuine-but-moderate issue rather than an urgent priority. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) describes a network-reachable, low-complexity flaw requiring only low-privilege (PR:L) authenticated access - consistent with the 'Subscriber' broken-access-control framing, since a Subscriber is the lowest self-registerable WordPress role. Impact is availability-only (A:H) with no confidentiality or integrity effect, which caps the ceiling at denial/disruption rather than data theft or takeover. Corroborating this, SSVC reads Exploitation: none, Automatable: no, Technical Impact: partial, and EPSS is low at 0.35% (28th percentile). There is no CISA KEV listing and no public exploit code referenced. The signals are internally consistent - no conflict between the CVSS network vector and the description, though note that PR:L means an attacker must first hold (or self-register) a Subscriber account, which many WordPress sites permit but many disable. Net: a real, patch-worthy authorization defect but not a widespread-exploitation emergency; prioritize based on whether the site allows open registration and how critical availability of the fundraising feature is. |
| Exploit ScenarioDerived | An attacker registers or obtains a low-privilege Subscriber account on a WordPress site running FundEngine <= 1.7.8, then invokes a plugin action that lacks a proper capability/authorization check. Because the endpoint only requires an authenticated session (PR:L) and no user interaction, the attacker triggers state changes that disrupt availability of the fundraising/donation functionality (A:H). No public proof-of-concept exploit is referenced at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Authenticated users holding only a Subscriber-level WordPress account can disrupt the fundraising functionality of sites running the FundEngine plugin (slug wp-fundraising-donation) through version 1.7.8, because a plugin action omits its capability and nonce authorization checks (CWE-862 missing authorization). The effect is limited to availability - there is no data disclosure or modification - and access requires an existing low-privilege login, which is realistic mainly where open user registration is enabled or the attacker already has an account. No public exploit code has been identified and there is no indication of active exploitation; EPSS is a low 0.35% (28th percentile) and CISA's SSVC framework rates exploitation as none, automatable as no, and technical impact as partial.
RemediationAI
The primary fix is to update the FundEngine plugin (wp-fundraising-donation) past the vulnerable range - the advisory identifies every release up to and including 1.7.8 as affected, so upgrade to the latest available release above 1.7.8; the provided data does not list a confirmed patched version number, so verify the exact fixed release in the Patchstack advisory before deploying. If an immediate upgrade is not possible, the highest-value compensating control is to deactivate the plugin entirely, accepting the loss of fundraising/donation functionality rather than exposing the unguarded action. Because exploitation requires a Subscriber-level login, reduce the attack surface by disabling open user registration (Settings > General > 'Anyone can register') and auditing existing accounts for unnecessary low-privilege users, though this will not help sites that intentionally allow public sign-ups or already host the attacker's account. Additional hardening options include reviewing the plugin's AJAX/REST routes and blocking the specific admin-ajax.php action at the WAF or reverse proxy, and rate-limiting or monitoring those endpoints; both carry trade-offs, since a WAF rule on admin-ajax.php actions is easy to bypass if the action name is not pinned down exactly and may break legitimate donation flows if over-broad. Note that no vendor patch version, workaround, or CISA KEV entry was provided in the available intelligence, so remediation should be validated against the advisory link above.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
FundEngine is a WordPress fundraising/donation plugin distributed as wp-fundraising-donation by the vendor Roxnor, matching the CPE cpe:2.3:a:roxnor:fundengine:*:*:*:*:*:*:*:* and tracked by ENISA as EUVD-2026-49227. The root cause class is CWE-862 (Missing Authorization): the plugin exposes an action or endpoint that performs a state-changing or resource-consuming operation without validating the caller's capability (for example a current_user_can() check) or a nonce (check_ajax_referer()/wp_verify_nonce()), which is a common failure mode in WordPress AJAX handlers registered via wp_ajax_* hooks. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H shows a remotely reachable, low-complexity path that nonetheless requires a low-privileged authenticated session and yields high availability impact only, with confidentiality and integrity scored as none; no scope change means the flaw stays within the plugin's own security authority. Patchstack's taxonomy labels the issue both 'Broken Access Control' and 'Authentication Bypass', but the assessed vector places the prerequisite at Subscriber level (PR:L) rather than unauthenticated, so this should be treated as a privilege-boundary/authorization gap rather than a true pre-auth bypass.
Know when Fundengine gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable but needs a low-privilege Subscriber account (PR:L); missing authorization is trivially triggered (AC:L); impact is availability-only (A:H) with no C/I effect.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Subscriber Broken Access Control in FundEngine <= 1.7.8 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Fundengine
View allThe WP Fundraising Donation and Crowdfunding Platform WordPress plugin before 1.5.0 does not sanitise and escape a param
Unauthenticated PHP Object Injection in the FundEngine WordPress fundraising/donation plugin (slug wp-fundraising-donati
Unauthenticated PHP object injection in the Roxnor FundEngine (wp-fundraising-donation) WordPress plugin through version
The FundEngine plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.0. R
Missing authorization in the FundEngine WordPress fundraising plugin (versions through 1.7.6) permits unauthenticated re
Exploit-DB