CVE-2026-75930 in FundEngine Plugin
Summary
by MITRE • 08/25/2026
The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary posts and pages — overwriting title and content, and seizing ownership by supplying an attacker-controlled post_author integer that bypasses wp_kses_post sanitization. The wp_rest nonce required by the handler is trivially obtainable by any logged-in user via /wp-admin/admin-ajax.php?action=rest-nonce and therefore does not constitute an authorization barrier.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/25/2026
The FundEngine Donation and Crowdfunding Platform plugin for WordPress contains a critical authorization bypass vulnerability affecting all versions up to 1.8.1. This flaw stems from insufficient verification of user permissions when handling administrative actions within the application. Specifically, the software fails to properly validate whether an authenticated user possesses the necessary privileges to execute certain operations on posts or pages. As a result, any attacker who has obtained subscriber-level access or higher can exploit this weakness to manipulate content arbitrarily. The vulnerability allows these attackers to overwrite post titles and contents while also seizing ownership of the affected items by injecting an attacker-controlled post_author integer value. This manipulation effectively transfers control of the compromised content from its legitimate owner to the malicious actor, undermining the integrity and trustworthiness of the platform's data structure.
From a technical perspective, the exploitation mechanism relies on bypassing standard WordPress security measures through careful parameter injection. The wp_kses_post function, which is typically employed to sanitize HTML tags and attributes in post content, fails to adequately restrict or validate the post_author field during this specific operation. By supplying an integer value corresponding to their own user ID or another target account, attackers can override default authorization checks embedded within the plugin’s backend logic. Furthermore, the wp_rest nonce required by the REST API handler does not serve as a meaningful barrier against exploitation. This token is trivially obtainable by any logged-in user through a simple request to /wp-admin/admin-ajax.php?action=rest-nonce. Consequently, the presence of this nonce provides no additional security benefit since it can be generated independently without requiring elevated privileges or special access rights beyond basic authentication status.
The operational impact of this vulnerability is significant for organizations relying on FundEngine for donation processing and crowdfunding campaigns. Unauthorized modification of posts could lead to defacement, dissemination of misleading information, or insertion of malicious links that compromise end-user trust. Seizing ownership of critical pages may allow attackers to redirect donations, alter campaign details, or remove essential legal disclaimers entirely. In severe cases, this could facilitate further attacks such as cross-site scripting if injected content includes executable scripts that bypass remaining sanitization layers. Additionally, the ability to change post authors complicates forensic analysis and accountability efforts since audit trails may reflect legitimate administrative actions rather than malicious intrusions.
This vulnerability aligns with CWE-284 Improper Access Control, where insufficient checks allow unauthorized users to perform restricted operations. It also maps closely to MITRE ATT&CK technique T1078 Valid Accounts, as exploitation requires valid credentials at minimum subscriber level but leverages flawed authorization logic rather than credential theft alone. Attackers typically follow a pattern consistent with Initial Access via Compromised Credentials followed by Privilege Escalation through misconfigured role-based access controls. The lack of proper input validation on critical fields like post_author represents a classic example of insecure direct object reference combined with broken access control principles commonly found in poorly secured WordPress plugins.
Mitigation strategies should prioritize immediate patching to the latest stable version released after 1.8.1, where developers have addressed these authorization gaps. Until updates are applied, administrators can implement temporary workarounds such as restricting REST API endpoints for lower-privileged users or disabling specific plugin features that expose vulnerable handlers. Enforcing strict role-based access policies ensures only editors and above interact with post modification functions. Additionally, deploying web application firewalls capable of detecting anomalous POST requests containing unexpected author ID changes may provide an extra layer of defense against automated exploitation attempts. Regular security audits focusing on authorization logic in third-party plugins remain essential to prevent similar vulnerabilities from impacting production environments.