CVE-2024-6698: Wpmet Fundengine Privilege Escalation Flaw

CVE-2024-6698 Overview

CVE-2024-6698 is a privilege escalation vulnerability in the FundEngine plugin for WordPress, developed by Wpmet. The flaw affects all versions up to and including 1.7.0. The plugin fails to properly verify user meta updates processed through the update_user_meta function. Authenticated users with subscriber-level access or higher can modify their own user meta to alter their capabilities. Successful exploitation grants attackers full administrator access to the affected WordPress site. The vulnerability is categorized under [CWE-862] (Missing Authorization).

Critical Impact
Authenticated attackers with subscriber-level access can escalate privileges to administrator, leading to full site compromise.

Affected Products

Wpmet FundEngine plugin for WordPress, all versions through 1.7.0
WordPress sites using the wp-fundraising-donation plugin package
Sites permitting user registration at subscriber level or above

Discovery Timeline

2024-08-01 - CVE-2024-6698 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6698

Vulnerability Analysis

The FundEngine plugin exposes functionality that calls the WordPress update_user_meta function without validating which meta keys the current user is authorized to modify. WordPress stores user capabilities and role assignments in the wp_capabilities user meta key. When a plugin allows arbitrary user meta writes without allow-listing the key or enforcing capability checks, an authenticated user can overwrite their own role data.

An attacker holding a subscriber account can submit a crafted request through the vulnerable endpoint. The request sets wp_capabilities (or an equivalent role-bearing key) to administrator. WordPress subsequently treats the account as an administrator on the next authenticated request. From that point the attacker can install plugins, modify site content, exfiltrate data, or plant persistent backdoors.

Root Cause

The root cause is missing authorization [CWE-862] around user meta modifications. The plugin passes user-controlled input to update_user_meta without verifying that the meta key falls outside sensitive keys such as wp_capabilities and without confirming the caller has the edit_users or promote_users capability.

Attack Vector

Exploitation is performed over the network against the WordPress site. The attacker must first authenticate as a subscriber or higher, which is often trivial on sites that permit open registration. The attacker then issues a POST request to the vulnerable plugin endpoint containing crafted user meta parameters. No user interaction from an administrator is required.

No verified public proof-of-concept code is currently available. See the Wordfence Vulnerability Analysis for additional technical detail.

Detection Methods for CVE-2024-6698

Indicators of Compromise

Unexpected changes to the wp_capabilities value in the wp_usermeta table for low-privilege accounts
Subscriber or contributor accounts suddenly appearing in the WordPress Administrators list
New administrator accounts created shortly after suspicious POST requests to FundEngine plugin endpoints
Installation of unfamiliar plugins or themes following requests to /wp-admin/admin-ajax.php referencing FundEngine actions

Detection Strategies

Audit the wp_usermeta table for any non-administrator user whose wp_capabilities entry contains administrator
Review WordPress access logs for authenticated POST requests to FundEngine AJAX or REST endpoints containing meta-related parameters
Enable and monitor WordPress role-change events using an activity logging plugin
Correlate role escalation events with the source IP and session that originated the request

Monitoring Recommendations

Alert on any modification to the wp_capabilities user meta key from non-administrative sessions
Track creation of new administrator-level accounts on WordPress sites running FundEngine
Monitor outbound traffic from the web server for indicators of post-compromise activity such as webshell callbacks

How to Mitigate CVE-2024-6698

Immediate Actions Required

Update the FundEngine plugin to a version later than 1.7.0 that includes the fix referenced in the WordPress Plugin Changeset
Audit all WordPress user accounts and remove any unauthorized administrators
Force password resets for all users and invalidate active sessions
Review installed plugins, themes, and mu-plugins for unauthorized additions

Patch Information

Wpmet addressed the vulnerability in the FundEngine plugin (package wp-fundraising-donation) via the changeset published on the WordPress plugin repository. Site operators should upgrade beyond version 1.7.0 through the WordPress admin dashboard or by replacing plugin files directly. Verify the plugin version after upgrade to confirm the fix is applied.

Workarounds

Deactivate and remove the FundEngine plugin until the patched version is deployed
Restrict WordPress user registration and set default new-user roles to the lowest privilege necessary
Deploy a web application firewall rule that blocks requests containing wp_capabilities in POST parameters to FundEngine endpoints
Limit access to /wp-admin/admin-ajax.php for unauthenticated and low-privilege users where feasible

bash

# Configuration example: WordPress CLI check for unauthorized administrators
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
wp db query "SELECT user_id, meta_value FROM wp_usermeta WHERE meta_key='wp_capabilities' AND meta_value LIKE '%administrator%';"