Executive brief
The FundEngine donation plugin for WordPress allows attackers with basic user accounts to modify, overwrite, or take ownership of any website posts and pages. An attacker can change page content and author information, potentially defacing the site, injecting malicious content, or hijacking important pages used for fundraising or communications. This affects all versions up to 1.8.1 and requires only a standard user login.
Technical details
The plugin fails to verify user authorization before allowing modifications to arbitrary posts and pages via a REST endpoint. Authenticated users (subscriber-level and above) can bypass access controls by supplying an attacker-controlled post_author parameter that circumvents wp_kses_post sanitization. The wp_rest nonce, which is supposed to protect the endpoint, is trivially obtainable by any logged-in user via /wp-admin/admin-ajax.php?action=rest-nonce, rendering it ineffective as a security barrier. An attacker can modify post titles, content, and ownership without proper capability checks. The vulnerability requires an active WordPress account, but the low privilege level required and ease of exploitation make this a significant risk for sites with open registration or multiple users.
Affected products
- The FundEngine The FundEngine – Donation and Crowdfunding Platform up to and including 1.8.1
Timeline
- 2026-08-25: disclosed
- other: CVE-2026-75930 assigned