The FundEngine – Donation and Crowdfunding Platform WordPress plugin suffers from a missing authorization vulnerability (CWE-862) in all versions up to 1.7.0. Specifically, the plugin fails to properly validate user meta data updates performed through the update_user_meta function. This flaw allows authenticated users with subscriber-level privileges or above to modify their user meta data in a way that escalates their capabilities, ultimately granting them administrator access. The vulnerability is network exploitable, requires low attack complexity, and no user interaction, with high impact on confidentiality, integrity, and availability as reflected by a CVSS 3.1 score of 8.8.

An attacker with subscriber-level access or higher can exploit this vulnerability to escalate their privileges to administrator level within the affected WordPress site. This could lead to full site compromise, including unauthorized access to sensitive data, modification of site content, and disruption of service. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user access and monitor for suspicious privilege changes. Avoid granting unnecessary user privileges and consider disabling or removing the FundEngine plugin if administrative control cannot be assured.