Crowdfundly
Monthly
Privilege escalation in the Crowdfundly WordPress plugin (versions through 2.2.2) allows an attacker who already holds one of the plugin's own low-privileged roles to grant themselves the WordPress administrator role or arbitrary capabilities, resulting in full site takeover. The flaw sits in AJAX actions that lack capability checks, so it is reachable remotely with no victim interaction, but the attacker must first obtain a legitimate low-privilege Crowdfundly account - trivial on sites that permit open self-registration of backers/campaigners, and a hard blocker on sites that restrict account creation. Publicly available exploit code exists (per the WPScan entry), while there is no confirmed active exploitation (CISA KEV); the independent assessment rates this as an authenticated privilege-escalation issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rather than the higher-privilege PR:H rating shown in some feeds.
Privilege escalation in the Crowdfundly WordPress plugin (versions through 2.2.2) allows an attacker who already holds one of the plugin's own low-privileged roles to grant themselves the WordPress administrator role or arbitrary capabilities, resulting in full site takeover. The flaw sits in AJAX actions that lack capability checks, so it is reachable remotely with no victim interaction, but the attacker must first obtain a legitimate low-privilege Crowdfundly account - trivial on sites that permit open self-registration of backers/campaigners, and a hard blocker on sites that restrict account creation. Publicly available exploit code exists (per the WPScan entry), while there is no confirmed active exploitation (CISA KEV); the independent assessment rates this as an authenticated privilege-escalation issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rather than the higher-privilege PR:H rating shown in some feeds.