CVE-2026-75930: FundEngine <= 1.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'campaign_post' Parameter
The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary posts and pages — overwriting title and content, and seizing ownership by supplying an attacker-controlled postauthor integer that bypasses wpksespost sanitization. The wprest nonce required by the handler is trivially obtainable by any logged-in user via /wp-admin/admin-ajax.php?action=rest-nonce and therefore does not constitute an authorization barrier.
Affected Software
Event History
Frequently Asked Questions
Which versions are affected?
All FundEngine versions up to and including 1.8.1 are affected.
Can a low-privileged WordPress account exploit this issue?
Yes. Any authenticated user with subscriber-level access or higher can exploit it; administrative privileges are not required.
Does the required REST nonce prevent exploitation?
No. Any logged-in user can trivially obtain the required wp_rest nonce from /wp-admin/admin-ajax.php?action=rest-nonce, so it does not provide an authorization barrier.
What can an attacker change if they exploit the issue?
An attacker can modify arbitrary posts and pages, including overwriting their titles and content. They can also supply an attacker-controlled post_author value to take ownership of affected content.