CVE-2026-85126: Crowdfundly <= 2.2.2 - Crowdfundly Manager+ Privilege Escalation
Published Oct 11, 2026
·Updated
The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, allowing users holding one of its own low privileged roles to grant themselves the administrator role or arbitrary capabilities, leading to a full site takeover.
Affected Software
1 affected component
Crowdfundly Crowdfundly WordPress plugin<=2.2.2
Event History
Oct 11, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·07:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which users are able to exploit this issue?
Users who hold one of the plugin’s own low-privileged roles can exploit the affected AJAX actions. An unauthenticated attacker is not described as being able to use this issue.
2
What access does successful exploitation provide?
An affected low-privileged user can grant themselves the WordPress administrator role or arbitrary capabilities. This can result in a full site takeover.
3
Which plugin versions are affected?
Crowdfundly WordPress plugin versions through 2.2.2 are affected.