CVE-2026-4650: FundPress WordPress Auth Bypass Flaw

CVE-2026-4650 Overview

CVE-2026-4650 is an authorization bypass vulnerability in the FundPress WordPress Donation Plugin affecting all versions up to and including 2.0.8. The flaw resides in the donate_action_status() AJAX handler, which is registered through wp_ajax_nopriv and accessible to unauthenticated users. The handler validates only that the schema parameter equals donate-ajax and that required POST parameters exist. It fails to verify user capabilities, nonce tokens, or donation ownership. Unauthenticated attackers can modify the status of any donation by supplying its sequential, enumerable ID. This vulnerability is tracked under [CWE-862: Missing Authorization].

Critical Impact
Remote unauthenticated attackers can change donation status records to completed, pending, cancelled, or arbitrary values, triggering email notifications and downstream side effects.

Affected Products

FundPress – WordPress Donation Plugin versions up to and including 2.0.8
FundPress trunk builds prior to changeset 3502937
WordPress sites running the vulnerable plugin with default wp_ajax_nopriv registration

Discovery Timeline

2026-05-02 - CVE-2026-4650 published to NVD
2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-4650

Vulnerability Analysis

The FundPress plugin exposes the donate_action_status() function as an AJAX endpoint registered with wp_ajax_nopriv_*. This registration explicitly permits unauthenticated callers to invoke the handler. Inside the handler, the plugin performs only two checks: it confirms that the schema POST parameter equals donate-ajax and that the expected parameters are present in the request body.

The handler does not call current_user_can() to confirm administrative privileges. It does not call wp_verify_nonce() or check_ajax_referer() to validate request authenticity. It also performs no ownership comparison between the requesting user and the targeted donation record.

Because donation IDs are auto-incrementing sequential integers, an attacker can iterate through the ID space and update arbitrary records. Status changes can mark donations as completed, pending, cancelled, or any string the application accepts. Each status change can trigger email notifications to administrators or donors and execute related workflow logic tied to donation state transitions.

Root Cause

The root cause is missing authorization on a state-modifying endpoint, classified as [CWE-862]. The combination of a public AJAX hook, absent nonce verification, and predictable resource identifiers allows direct object manipulation by anonymous attackers. Source review of inc/class-dn-ajax.php lines 173-179 and inc/class-dn-donate.php line 189 confirms the missing capability and nonce checks.

Attack Vector

Exploitation occurs over the network against the WordPress admin-ajax.php endpoint. The attacker issues a POST request containing the action, schema=donate-ajax, the target donation id, and the desired status value. No authentication, session, or user interaction is required. Attackers typically enumerate IDs starting at 1 to discover valid donation records before issuing batch status updates.

The vulnerability is exploited via crafted POST requests to admin-ajax.php targeting the unauthenticated
donate_action_status AJAX handler. See the WordPress plugin source references for the vulnerable code paths.

Detection Methods for CVE-2026-4650

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing schema=donate-ajax originating from unauthenticated sessions or unfamiliar IP addresses
Sequential donation ID enumeration patterns within web server access logs
Unexpected donation status transitions in the FundPress database tables without corresponding user activity
Bursts of donation status notification emails sent without administrative action

Detection Strategies

Monitor web server logs for high-volume requests to admin-ajax.php with the FundPress action and incrementing id values
Audit the FundPress donation status history for changes made outside of normal admin sessions or business hours
Alert on wp_ajax_nopriv invocations of donation handlers from non-payment-gateway source IPs
Correlate outbound donation notification emails with corresponding authenticated admin activity to identify orphaned status changes

Monitoring Recommendations

Enable WordPress audit logging plugins to record all donation table modifications with originating IP and user context
Forward web access logs and WordPress activity logs to a centralized SIEM for correlation and retention
Track baseline rates of donation status transitions and trigger alerts on statistical anomalies
Review email gateway logs for surges in donation-related notifications that lack matching admin login events

How to Mitigate CVE-2026-4650

Immediate Actions Required

Update the FundPress plugin to a version newer than 2.0.8 that includes the fix from changeset 3502937
If immediate patching is not possible, deactivate the FundPress plugin until the upgrade can be deployed
Review donation records for unauthorized status changes and restore correct values from backups where needed
Block unauthenticated POST requests to admin-ajax.php containing schema=donate-ajax at the web application firewall layer

Patch Information

The vendor addressed the missing authorization issue in WordPress FundPress Changeset 3502937. Refer to the Wordfence Vulnerability Advisory for confirmed fixed versions and additional remediation guidance. Source diffs are available in the FundPress 2.0.9 source tree.

Workarounds

Deploy a WAF rule that blocks unauthenticated requests where the schema parameter equals donate-ajax
Restrict access to admin-ajax.php for the FundPress action to authenticated administrative IP ranges
Temporarily remove the wp_ajax_nopriv_donate_action_status registration via a custom must-use plugin until the official patch is applied
Disable donation status notification emails to limit downstream impact while remediation is in progress

bash

# Example WAF rule (ModSecurity) to block the vulnerable request pattern
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,id:1004650,phase:2,deny,status:403,msg:'Block FundPress CVE-2026-4650 unauthenticated status change'"
  SecRule ARGS:schema "@streq donate-ajax" \
    "chain"
    SecRule &REQUEST_HEADERS:Cookie "@eq 0"