Access Control Flaw in Roxnor FundEngine Plugin for WordPress
CVE-2026-57406

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Fundengine
Vendor
CVE Published:
13 July 2026

What is CVE-2026-57406?

The Roxnor FundEngine plugin for WordPress has a critical missing authorization vulnerability that allows unauthorized access due to improperly configured security levels. This flaw impacts versions up to 1.7.6, enabling attackers to exploit misconfigurations and gain elevated privileges. Website administrators are urged to update their FundEngine plugin to mitigate potential security risks.

Affected Version(s)

FundEngine 0 <= 1.7.6

References

https://patchstack.com/database/Wordpress/Plugin/wp-fundr...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Peng Zhou | Patchstack Bug Bounty Program
.