CVE-2026-59560 Overview
CVE-2026-59560 is a broken access control vulnerability affecting the FundEngine WordPress plugin (also distributed as wp-fundraising-donation) in versions up to and including 1.7.8. The flaw allows authenticated users at the Subscriber role level to perform actions that should be restricted to higher-privileged accounts. The underlying weakness is a missing authorization check, categorized under [CWE-862]. Successful exploitation impacts the availability of the WordPress site while leaving confidentiality and integrity unaffected, according to the published CVSS vector.
Critical Impact
Any authenticated Subscriber can trigger actions on the FundEngine plugin that disrupt site availability due to missing authorization checks.
Affected Products
- FundEngine WordPress plugin (wp-fundraising-donation) versions <= 1.7.8
- WordPress installations with the FundEngine plugin activated
- Sites permitting Subscriber-level registration with the vulnerable plugin enabled
Discovery Timeline
- 2026-07-27 - CVE CVE-2026-59560 published to NVD
- 2026-07-27 - Last updated in NVD database
Technical Details for CVE-2026-59560
Vulnerability Analysis
The FundEngine plugin exposes functionality that fails to verify the caller's role or capability before executing sensitive operations. A Subscriber, which is the lowest privileged authenticated role in WordPress, can invoke these endpoints and cause impact to the site. The published CVSS vector indicates network-reachable, low-complexity exploitation requiring low privileges and no user interaction, with a high impact to availability. Confidentiality and integrity are unaffected, meaning the flaw does not directly leak data or modify persistent content in a way that violates trust boundaries, but the ability to disrupt operations remains material.
The EPSS probability is 0.352% with a percentile of 27.91, reflecting a modest likelihood of exploitation attempts within the near term. WordPress sites that allow open user registration face the greatest exposure, because any visitor can obtain the Subscriber role required to reach the vulnerable code paths.
Root Cause
The root cause is a missing authorization check ([CWE-862]) in one or more plugin request handlers. The affected endpoints do not call WordPress capability functions such as current_user_can() or verify nonces bound to a privileged role before running their logic. As a result, the plugin treats any authenticated session as authorized to perform restricted actions.
Attack Vector
An attacker registers or logs in as a Subscriber on a site running FundEngine <= 1.7.8. The attacker then sends a crafted HTTP request to the vulnerable plugin endpoint. Because no capability check exists, the plugin processes the request and performs the restricted action, degrading availability of the fundraising functionality or the surrounding site. Refer to the Patchstack advisory for endpoint-specific details.
Detection Methods for CVE-2026-59560
Indicators of Compromise
- Unexpected POST or admin-ajax.php requests to FundEngine plugin actions originating from Subscriber accounts
- Sudden availability degradation of donation forms, campaigns, or related fundraising pages
- New Subscriber accounts followed shortly by requests to wp-fundraising-donation endpoints
Detection Strategies
- Inspect WordPress access logs for authenticated requests to FundEngine handlers issued by low-privileged users
- Audit the WordPress users table for recently created Subscriber accounts that immediately interacted with the plugin
- Correlate spikes in admin-ajax.php or REST API activity with reports of broken fundraising features
Monitoring Recommendations
- Enable WordPress activity logging with role attribution for every plugin action
- Alert on requests to FundEngine endpoints where the acting user role is subscriber
- Track plugin version inventory across all managed WordPress sites and flag hosts still on <= 1.7.8
How to Mitigate CVE-2026-59560
Immediate Actions Required
- Identify every WordPress instance running FundEngine (wp-fundraising-donation) at version 1.7.8 or earlier
- Update the plugin to a fixed release as identified in the Patchstack advisory
- Temporarily disable open user registration if a patched version is not yet deployed
- Review Subscriber-level accounts and remove any created without a clear business purpose
Patch Information
Refer to the Patchstack Security Vulnerability entry for the vendor's fixed release and upgrade instructions. Apply the update through the WordPress plugin manager or WP-CLI.
Workarounds
- Disable the FundEngine plugin until an upgrade is applied
- Restrict access to admin-ajax.php and plugin REST routes at the web application firewall for non-authenticated and Subscriber roles
- Set users_can_register to false in WordPress general settings to prevent unprivileged account creation
# Configuration example
wp plugin update wp-fundraising-donation
wp option update users_can_register 0
wp user list --role=subscriber --fields=ID,user_login,user_registered
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
