CVE-2026-75930

Name of the Vulnerable Software and Affected Versions FundEngine – Donation and Crowdfunding Platform plugin for WordPress versions prior to 1.8.2

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can modify arbitrary posts and pages, allowing them to overwrite titles and content. Attackers can also seize ownership of content by providing a controlled post author integer, which bypasses the wp kses post sanitization function. The required wp rest nonce is easily obtainable by any logged-in user via the /wp-admin/admin-ajax.php?action=rest-nonce endpoint, meaning it does not provide an effective authorization barrier.

Recommendations Update the plugin to version 1.8.2 or later.