Fundengine
Monthly
Unauthenticated PHP object injection in the Roxnor FundEngine (wp-fundraising-donation) WordPress plugin through version 1.7.9 lets remote attackers pass attacker-controlled serialized data into a PHP unserialize() sink without authentication. If a suitable POP gadget chain is present in the plugin, WordPress core, or another installed plugin, this can escalate to arbitrary code execution, file operations, or SQL manipulation. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated PHP Object Injection in the FundEngine WordPress fundraising/donation plugin (slug wp-fundraising-donation) affects all versions up to and including 1.7.9, letting a remote attacker with no authentication inject a crafted serialized PHP object into an application deserialization sink. Given the CWE-502 root cause and the PR:N/UI:N vector, a successful attack can pivot to remote code execution, data theft, or full site takeover when a suitable POP gadget chain is reachable. Reported by Patchstack and rated CVSS 9.8, with no public exploit identified at time of analysis and no CISA KEV listing.
Authenticated users holding only a Subscriber-level WordPress account can disrupt the fundraising functionality of sites running the FundEngine plugin (slug wp-fundraising-donation) through version 1.7.8, because a plugin action omits its capability and nonce authorization checks (CWE-862 missing authorization). The effect is limited to availability - there is no data disclosure or modification - and access requires an existing low-privilege login, which is realistic mainly where open user registration is enabled or the attacker already has an account. No public exploit code has been identified and there is no indication of active exploitation; EPSS is a low 0.35% (28th percentile) and CISA's SSVC framework rates exploitation as none, automatable as no, and technical impact as partial.
Missing authorization in the FundEngine WordPress fundraising plugin (versions through 1.7.6) permits unauthenticated remote attackers to exploit incorrectly configured access control, resulting in partial data integrity and availability impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity, unauthenticated network exploitation with no user interaction required. No active exploitation is confirmed in the CISA KEV catalog, and no public exploit code has been identified at the time of this analysis.
The FundEngine plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The WP Fundraising Donation and Crowdfunding Platform WordPress plugin before 1.5.0 does not sanitise and escape a parameter before using it in a SQL statement via one of it's REST route, leading to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated PHP object injection in the Roxnor FundEngine (wp-fundraising-donation) WordPress plugin through version 1.7.9 lets remote attackers pass attacker-controlled serialized data into a PHP unserialize() sink without authentication. If a suitable POP gadget chain is present in the plugin, WordPress core, or another installed plugin, this can escalate to arbitrary code execution, file operations, or SQL manipulation. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated PHP Object Injection in the FundEngine WordPress fundraising/donation plugin (slug wp-fundraising-donation) affects all versions up to and including 1.7.9, letting a remote attacker with no authentication inject a crafted serialized PHP object into an application deserialization sink. Given the CWE-502 root cause and the PR:N/UI:N vector, a successful attack can pivot to remote code execution, data theft, or full site takeover when a suitable POP gadget chain is reachable. Reported by Patchstack and rated CVSS 9.8, with no public exploit identified at time of analysis and no CISA KEV listing.
Authenticated users holding only a Subscriber-level WordPress account can disrupt the fundraising functionality of sites running the FundEngine plugin (slug wp-fundraising-donation) through version 1.7.8, because a plugin action omits its capability and nonce authorization checks (CWE-862 missing authorization). The effect is limited to availability - there is no data disclosure or modification - and access requires an existing low-privilege login, which is realistic mainly where open user registration is enabled or the attacker already has an account. No public exploit code has been identified and there is no indication of active exploitation; EPSS is a low 0.35% (28th percentile) and CISA's SSVC framework rates exploitation as none, automatable as no, and technical impact as partial.
Missing authorization in the FundEngine WordPress fundraising plugin (versions through 1.7.6) permits unauthenticated remote attackers to exploit incorrectly configured access control, resulting in partial data integrity and availability impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity, unauthenticated network exploitation with no user interaction required. No active exploitation is confirmed in the CISA KEV catalog, and no public exploit code has been identified at the time of this analysis.
The FundEngine plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The WP Fundraising Donation and Crowdfunding Platform WordPress plugin before 1.5.0 does not sanitise and escape a parameter before using it in a SQL statement via one of it's REST route, leading to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.