CVE-2026-4650 Missing authorization in FundPress – WordPress Donation Plugin
Unauthenticated attackers can modify the status of any donation in FundPress by exploiting missing authorization checks in the AJAX handler.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-4650?
CVE-2026-4650 is a medium-severity missing authorization vulnerability in thimpress FundPress – WordPress Donation Plugin, published on 2 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The FundPress – WordPress Donation Plugin for WordPress is vulnerable to authorization bypass in versions up to and including 2.0.8. This is due to missing authorization and nonce verification in the donate_action_status() AJAX handler, which is registered to be accessible to unauthenticated users via wp_ajax_nopriv. The function only validates that the schema parameter equals 'donate-ajax' and that the required POST parameters are present, but fails to verify user capabilities, nonce tokens, or donation ownership. This makes it possible for unauthenticated attackers to modify the status of any donation by providing its ID (which are sequential integers and easily enumerable), allowing them to mark donations as completed, pending, cancelled, or any arbitrary status, potentially triggering email notifications and related side effects.
Weakness: CWE-862
Which versions are affected by CVE-2026-4650?
How do I fix CVE-2026-4650?
No fix has been published for CVE-2026-4650 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-4650 being exploited?
There is no known exploitation of CVE-2026-4650 in the wild and no public exploit code.
Sources
Also known as GHSA-59hp-h3hq-6gmv.