The FundPress WordPress Donation Plugin versions up to 2.0.8 contain an authorization bypass vulnerability (CWE-862) in the donate_action_status() AJAX handler. This handler is accessible to unauthenticated users via wp_ajax_nopriv and only validates a schema parameter and presence of POST parameters, but does not verify user capabilities, nonce tokens, or ownership of the donation. Because donation IDs are sequential and enumerable, an attacker can change the status of arbitrary donations to any state such as completed, pending, or cancelled, potentially causing unintended side effects like email notifications.

The vulnerability allows unauthenticated attackers to modify the status of any donation in the FundPress plugin. This can lead to integrity issues with donation records and may trigger unintended email notifications or related processes. There is no direct confidentiality or availability impact reported. The CVSS score is 5.3 (medium severity), reflecting the integrity impact without elevated privileges or user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the vulnerable AJAX handler or restricting access to it via custom code or security plugins. Monitoring for unusual donation status changes may help detect exploitation attempts. Avoid relying on the plugin for critical donation status integrity until the issue is resolved.