PT-2026-36589 · WordPress · Fundpress
Published
2026-05-02
·
Updated
2026-05-02
·
CVE-2026-4650
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
FundPress versions prior to 2.0.9
Description
An authorization bypass exists in the FundPress WordPress Donation Plugin. The
donate action status() AJAX handler, accessible to unauthenticated users via wp ajax nopriv, fails to verify user capabilities, nonce tokens, or donation ownership. It only validates that the schema parameter equals 'donate-ajax' and that required POST parameters are present. Consequently, unauthenticated attackers can modify the status of any donation by providing its sequential integer ID, allowing them to mark donations as completed, pending, cancelled, or any arbitrary status, which may trigger email notifications and other side effects.Recommendations
Update the plugin to a version later than 2.0.8.
As a temporary workaround, restrict access to the
donate action status() function to minimize the risk of exploitation.Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Fundpress