# CVE-2026-59560: Roxnor FundEngine broken access control in WordPress plugin

Source: https://junglewise.ai/threats/cve-2026-59560-roxnor-fundengine-broken-access-control-in-wordpress-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-27. Updated: 2026-07-27  
License: CC BY 4.0 with a link back

CVE-2026-59560 · Severity: medium · CVSS 6.5 · Published 2026-07-27

FundEngine, a WordPress plugin used for managing fundraising and donations, contains a security flaw that allows users with basic 'Subscriber' accounts to perform actions they should not be authorized to access. This could allow a low-level user to interfere with the plugin's operations, potentially leading to a service disruption or unauthorized changes to fundraising activities. Organizations using this plugin should update to the latest version to ensure only authorized administrators can manage donation settings.

Technologies: [Roxnor FundEngine](https://junglewise.ai/threats/technologies/fundengine). Vendors: [Roxnor](https://junglewise.ai/threats/vendors/roxnor).

## Quick answers

**Is CVE-2026-59560 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59560 being exploited in the wild.

**How severe is CVE-2026-59560?** Medium severity, with a CVSS score of 6.5, published 27 July 2026.

**Which products and versions are affected?** Roxnor FundEngine <= 1.7.8.

**Is there a fix for CVE-2026-59560?** A patch was published on 2026-07-27: Version 1.7.9 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59560 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-59560?** Check whether you run Roxnor FundEngine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The FundEngine plugin (wp-fundraising-donation) for WordPress, versions up to and including 1.7.8, suffers from a broken access control vulnerability due to missing authorization checks (CWE-862). An attacker authenticated with a low-level 'Subscriber' role can exploit this flaw to execute functions or access endpoints that should be restricted to higher-privileged users. According to the CVSS vector, the primary impact is on availability (A:H), suggesting that unauthorized access could be used to disrupt plugin functionality. The issue is resolved in version 1.7.9.

## Affected products

- Roxnor FundEngine (wp-fundraising-donation) <= 1.7.8

## Timeline

- 2026-05-26: other: Reported by Septio Noerdiansyah
- 2026-07-27: advisory: Published by Patchstack and NVD
- 2026-07-27: patched: Version 1.7.9 released to address the vulnerability

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/wp-fundraising-donation/vulnerability/wordpress-fundengine-plugin-1-7-8-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/wp-fundraising-donation/vulnerability/wordpress-fundengine-plugin-1-7-8-broken-access-control-vulnerability?_s_id=cve)

## Related threats

- [Roxnor FundEngine missing authorization in wp-fundraising-donation](https://junglewise.ai/threats/cve-2026-57406-roxnor-fundengine-missing-authorization-in-wp-fundraising)