Fundengine
Monthly
Unauthenticated PHP object injection in the Roxnor FundEngine (wp-fundraising-donation) WordPress plugin through version 1.7.9 lets remote attackers pass attacker-controlled serialized data into a PHP unserialize() sink without authentication. If a suitable POP gadget chain is present in the plugin, WordPress core, or another installed plugin, this can escalate to arbitrary code execution, file operations, or SQL manipulation. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated PHP Object Injection in the FundEngine WordPress fundraising/donation plugin (slug wp-fundraising-donation) affects all versions up to and including 1.7.9, letting a remote attacker with no authentication inject a crafted serialized PHP object into an application deserialization sink. Given the CWE-502 root cause and the PR:N/UI:N vector, a successful attack can pivot to remote code execution, data theft, or full site takeover when a suitable POP gadget chain is reachable. Reported by Patchstack and rated CVSS 9.8, with no public exploit identified at time of analysis and no CISA KEV listing.
We need to parse the input and produce a JSON. Let's extract all provided data: CVE ID: CVE-2026-59560 Description: "Subscriber Broken Access Control in FundEngine <= 1.7.8 versions." That's all. Very sparse. CVSS Score: 6.5 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CWE: CWE-862 (Missing Authorization) Multi-source intelligence: Reported by: Patchstack CPE: cpe:2.3:a:roxnor:fundengine:*:*:*:*:*:*:*:* (implies version <=1.7.8 from affected versions) Tags: Authentication Bypass, Fundengine (tags from probably Patchstack) ENISA EUVD ID: EUVD-2026-49227 Affected versions (EUVD): ["FundEngine n/a ≤1.7.8"] - note the "n/a" maybe they say version up to 1.7.8. References: [cveorg] (None) but URL: https://patchstack.com/database/wordpress/plugin/wp-fundraising-donation/vulnerability/wordpress-fundengine-plugin-1-7-8-broken-access-control-vulnerability?_s_id=cve We have no EPSS, no KEV status, no POC availability explicitly in the data. So we'll assume none provided. However, we must synthesize. The vulnerability is "Subscriber Broken Access Control", CWE-862 Missing Authorization. CVSS: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H -> high availability impact, no confidentiality/integrity. So an authenticated subscriber (low privilege) can cause a denial of service. The product is FundEngine, a WordPress plugin for fundraising/donation. So likely a WordPress plugin. Vendor: roxnor. The reference leads to Patchstack database. Patchstack often lists these. We need to infer from the URL: "wordpress-fundengine-plugin-1-7-8-broken-access-control-vulnerability". So it's in the wp-fundraising-donation plugin. The product name: FundEngine. So product_name: "FundEngine" (WordPress plugin). The description is "Subscriber Broken Access Control in FundEngine <= 1.7.8 versions." We need to write summary: original synthesis, not paraphrasing description. So what can a low-privileged subscriber do? They can cause a denial of service (from CVSS A:H). The description says broken
Missing authorization in the FundEngine WordPress fundraising plugin (versions through 1.7.6) permits unauthenticated remote attackers to exploit incorrectly configured access control, resulting in partial data integrity and availability impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity, unauthenticated network exploitation with no user interaction required. No active exploitation is confirmed in the CISA KEV catalog, and no public exploit code has been identified at the time of this analysis.
The FundEngine plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The WP Fundraising Donation and Crowdfunding Platform WordPress plugin before 1.5.0 does not sanitise and escape a parameter before using it in a SQL statement via one of it's REST route, leading to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated PHP object injection in the Roxnor FundEngine (wp-fundraising-donation) WordPress plugin through version 1.7.9 lets remote attackers pass attacker-controlled serialized data into a PHP unserialize() sink without authentication. If a suitable POP gadget chain is present in the plugin, WordPress core, or another installed plugin, this can escalate to arbitrary code execution, file operations, or SQL manipulation. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated PHP Object Injection in the FundEngine WordPress fundraising/donation plugin (slug wp-fundraising-donation) affects all versions up to and including 1.7.9, letting a remote attacker with no authentication inject a crafted serialized PHP object into an application deserialization sink. Given the CWE-502 root cause and the PR:N/UI:N vector, a successful attack can pivot to remote code execution, data theft, or full site takeover when a suitable POP gadget chain is reachable. Reported by Patchstack and rated CVSS 9.8, with no public exploit identified at time of analysis and no CISA KEV listing.
We need to parse the input and produce a JSON. Let's extract all provided data: CVE ID: CVE-2026-59560 Description: "Subscriber Broken Access Control in FundEngine <= 1.7.8 versions." That's all. Very sparse. CVSS Score: 6.5 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CWE: CWE-862 (Missing Authorization) Multi-source intelligence: Reported by: Patchstack CPE: cpe:2.3:a:roxnor:fundengine:*:*:*:*:*:*:*:* (implies version <=1.7.8 from affected versions) Tags: Authentication Bypass, Fundengine (tags from probably Patchstack) ENISA EUVD ID: EUVD-2026-49227 Affected versions (EUVD): ["FundEngine n/a ≤1.7.8"] - note the "n/a" maybe they say version up to 1.7.8. References: [cveorg] (None) but URL: https://patchstack.com/database/wordpress/plugin/wp-fundraising-donation/vulnerability/wordpress-fundengine-plugin-1-7-8-broken-access-control-vulnerability?_s_id=cve We have no EPSS, no KEV status, no POC availability explicitly in the data. So we'll assume none provided. However, we must synthesize. The vulnerability is "Subscriber Broken Access Control", CWE-862 Missing Authorization. CVSS: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H -> high availability impact, no confidentiality/integrity. So an authenticated subscriber (low privilege) can cause a denial of service. The product is FundEngine, a WordPress plugin for fundraising/donation. So likely a WordPress plugin. Vendor: roxnor. The reference leads to Patchstack database. Patchstack often lists these. We need to infer from the URL: "wordpress-fundengine-plugin-1-7-8-broken-access-control-vulnerability". So it's in the wp-fundraising-donation plugin. The product name: FundEngine. So product_name: "FundEngine" (WordPress plugin). The description is "Subscriber Broken Access Control in FundEngine <= 1.7.8 versions." We need to write summary: original synthesis, not paraphrasing description. So what can a low-privileged subscriber do? They can cause a denial of service (from CVSS A:H). The description says broken
Missing authorization in the FundEngine WordPress fundraising plugin (versions through 1.7.6) permits unauthenticated remote attackers to exploit incorrectly configured access control, resulting in partial data integrity and availability impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity, unauthenticated network exploitation with no user interaction required. No active exploitation is confirmed in the CISA KEV catalog, and no public exploit code has been identified at the time of this analysis.
The FundEngine plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The WP Fundraising Donation and Crowdfunding Platform WordPress plugin before 1.5.0 does not sanitise and escape a parameter before using it in a SQL statement via one of it's REST route, leading to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.