Authorization Bypass in FundEngine Donation and Crowdfunding Platform for WordPress

CVE-2026-75930

What is CVE-2026-75930?

The FundEngine plugin for WordPress contains an authorization bypass vulnerability affecting all versions up to and including 1.8.1. This flaw arises from the plugin's inadequate verification process to ensure that users have the appropriate permissions to execute specific actions. As a result, authenticated attackers with subscriber-level access can manipulate content by modifying arbitrary posts and pages, including altering titles and body text. The attacker's ability to seize ownership of posts is facilitated by providing a controlled post_author integer that evades wp_kses_post sanitization measures. Moreover, the necessary wp_rest nonce can be easily accessed by any logged-in user through a simple action, which fails to serve as an effective authorization mechanism.

References