Description

The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts despite not being granted that permission.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-12T06:17:47.640Z",
  "pubdate": "2026-08-12T06:17:47.640Z",
  "executiveSummary": "An authorization bypass vulnerability exists in the WP Crowdfunding WordPress plugin prior to version 2.2.1.\nThe vulnerability arises from a missing capability check within one of the plugin's backend AJAX actions.\nAuthenticated users, specifically those assigned the low-privileged Subscriber role, can exploit this flaw to create unauthorized crowdfunding campaign posts.\nThis unauthorized creation of campaign posts violates the principle of least privilege and core access control policies defined within the application.\nSuccessful exploitation requires the attacker to possess authenticated access to the target WordPress instance, albeit with minimal privileges.\nThe impact of this vulnerability includes unauthorized content generation, potential database pollution, and the circumvention of administrative publishing controls.\nRisk implications remain moderate due to the requirement of authentication, yet the flaw successfully degrades the integrity of the content management system by allowing unauthorized privilege escalation regarding campaign generation capabilities.",
  "technicalDetails": "The root cause of the vulnerability is the absence of proper permission verification and capability checks in a specific AJAX action handler utilized by the WP Crowdfunding WordPress plugin.\nIn WordPress architecture, AJAX endpoints must explicitly validate user capabilities—such as publish_posts or edit_posts—using functions like current_user_can() before processing state-changing requests.\nThe vulnerable component fails to enforce these checks, allowing any authenticated user, regardless of their assigned role, to invoke the AJAX action responsible for campaign submission.\nThe attack flow begins when an authenticated low-privileged user, such as a Subscriber, crafts an HTTP POST request targeting the vulnerable AJAX endpoint exposed by the WP Crowdfunding plugin.\nThe payload supplied within the request includes the necessary parameters to instantiate a new crowdfunding campaign post.\nBecause the underlying endpoint omits authorization validation, the application processes the incoming parameters and successfully creates the post in the database.\nAuthentication requirements are limited to a standard, valid user session with minimal privileges, such as the Subscriber role.\nNo elevated privileges or administrative capabilities are required by the attacking user to trigger the flaw.\nThe network exposure is bounded by the web interface of the WordPress installation, making the endpoint reachable over HTTP/HTTPS by any user capable of authenticating to the site.\nThe post-exploitation impact includes the unauthorized insertion of custom post types associated with crowdfunding campaigns, which could lead to spam generation, defacement, or preparatory stages for further complex attacks depending on subsequent plugin functionalities."
}