Authorization Bypass in FundPress Donation Plugin for WordPress

CVE-2026-4650

What is CVE-2026-4650?

The FundPress Donation Plugin for WordPress has a vulnerability that allows unauthenticated users to bypass authorization controls. Specifically, the donate_action_status() AJAX handler lacks essential verification, permitting attackers to modify donation statuses by merely knowing the donation ID. The vulnerability exists due to insufficient capability checks, nonce validation, and ownership verification, enabling external users to mark donations as completed, pending, or cancelled, which may lead to unintended notifications and potential misuse.

References