CVE-2026-75930: FundEngine WordPress Plugin Auth Bypass

CVE-2026-75930 Overview

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress contains a missing authorization vulnerability [CWE-862] in all versions up to and including 1.8.1. The plugin fails to verify that a user is authorized to perform post modification actions. Authenticated attackers with subscriber-level access can modify arbitrary posts and pages, overwriting title and content while seizing ownership by supplying an attacker-controlled post_author integer. The wp_kses_post sanitization does not restrict the authorship assignment, and the wp_rest nonce required by the handler is trivially obtainable through /wp-admin/admin-ajax.php?action=rest-nonce.

Critical Impact
Any authenticated WordPress user, including low-privilege subscribers, can rewrite site content and reassign post ownership on affected installations.

Affected Products

FundEngine – Donation and Crowdfunding Platform plugin for WordPress, versions up to and including 1.8.1
WordPress sites running the wp-fundraising-donation plugin with subscriber registration enabled
Deployments that expose /wp-admin/admin-ajax.php to authenticated users

Discovery Timeline

2026-08-25 - CVE-2026-75930 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-75930

Vulnerability Analysis

The FundEngine plugin registers REST-style handlers for managing donation-related content but does not verify that the requesting user owns or has edit rights to the target post. The vulnerability is classified as Missing Authorization [CWE-862]. Because WordPress capability checks (current_user_can('edit_post', $post_id)) are absent, any authenticated session, including the default subscriber role, can invoke the update path. The handler additionally accepts an post_author parameter, allowing the caller to reassign a targeted post to any user ID.

Root Cause

The root cause is the plugin's reliance on nonce presence as an authorization signal instead of a capability check. The wp_rest nonce is a CSRF control, not an access control. Any logged-in user can request a valid nonce from /wp-admin/admin-ajax.php?action=rest-nonce and replay it against the plugin's content update endpoints. Sanitization via wp_kses_post is applied to HTML content only and does not constrain which post ID or post_author value the request carries.

Attack Vector

An attacker registers or logs in as a subscriber, requests a wp_rest nonce, then issues a POST request to the vulnerable FundEngine handler with a target post_id, arbitrary post_title, post_content, and a post_author integer pointing at their own account. The server executes the update without validating the caller's edit capability. See the Wordfence Vulnerability Report and the vulnerable WordPress Plugin Content Code for handler-level details.

No verified proof-of-concept code has been published. Refer to the plugin source references above for the exact handler locations.

Detection Methods for CVE-2026-75930

Indicators of Compromise

Unexpected changes to post_title, post_content, or post_author fields in wp_posts performed by low-privilege user accounts.
Web server access logs showing subscriber-role sessions issuing POST requests to FundEngine plugin endpoints under /wp-json/ or admin-ajax.php.
Requests to admin-ajax.php?action=rest-nonce from accounts that have no legitimate need to interact with the REST API.
Newly registered subscriber accounts followed shortly by post ownership changes.

Detection Strategies

Audit the WordPress wp_posts table for post_author values that no longer match the original creator, and cross-reference with revision history.
Enable WordPress activity logging plugins to record content modification events with the acting user role and IP.
Alert on any HTTP request to FundEngine handler paths where the authenticated session role is subscriber.

Monitoring Recommendations

Forward WordPress audit logs and web access logs to a centralized SIEM for correlation across authentication, nonce retrieval, and content-modification events.
Monitor for spikes in rest-nonce retrieval requests followed by POST traffic to plugin endpoints.
Track post revision anomalies where content diffs are large and originate from non-editor roles.

How to Mitigate CVE-2026-75930

Immediate Actions Required

Update the FundEngine – Donation and Crowdfunding Platform plugin to a version released after 1.8.1 that addresses the missing authorization check.
Disable open user registration on WordPress sites that do not require it, or restrict new registrations to a role with no site access.
Review the wp_posts table and post revisions for unauthorized modifications and restore affected content from backup where needed.
Audit user accounts created during the exposure window and remove accounts that were not legitimately provisioned.

Patch Information

A fix was committed upstream. See the vendor WordPress Code Changeset for the corrected handler logic, and the Wordfence Vulnerability Report for fixed-version guidance.

Workarounds

Deactivate the FundEngine plugin until the patched version can be installed.
Apply a web application firewall rule that blocks unauthenticated or subscriber-role requests to FundEngine content-modification endpoints.
Restrict access to admin-ajax.php and /wp-json/ for untrusted IP ranges through the reverse proxy or WAF.

bash

# Example WAF rule concept: block subscriber-role POSTs to FundEngine handlers
# (adapt to your WAF syntax and confirmed plugin route paths)
SecRule REQUEST_URI "@rx /wp-json/.*fundraising|wp-fundraising-donation" \
  "phase:2,deny,status:403,id:1026075930,\
   msg:'Block CVE-2026-75930 FundEngine authorization bypass',\
   chain"
  SecRule REQUEST_METHOD "@streq POST"