This vulnerability in Roxnor FundEngine (wp-fundraising-donation) arises from missing authorization controls, allowing unauthorized users to bypass access restrictions due to incorrectly configured access control security levels. The issue affects FundEngine versions up to 1.7.6. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, but integrity and availability impacts. No vendor advisory or patch information is provided, and no known exploits have been reported.

Exploitation of this vulnerability can lead to unauthorized modification or disruption of FundEngine functionality, impacting data integrity and availability. Confidentiality is not affected. The medium CVSS score reflects these impacts without elevated privileges or user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and tighten access control configurations in FundEngine to mitigate risk. Monitor for vendor updates regarding patches or official mitigations.