CVE-2026-75930 is an authorization bypass vulnerability (CWE-862) in the FundEngine – Donation and Crowdfunding Platform WordPress plugin affecting all versions up to and including 1.8.1. The plugin does not correctly verify that a user is authorized to perform certain actions, allowing authenticated users with subscriber-level privileges or higher to modify arbitrary posts and pages. Attackers can overwrite the title and content and seize ownership by supplying an attacker-controlled post_author integer that bypasses wp_kses_post sanitization. The required wp_rest nonce is trivially obtainable by any logged-in user via the /wp-admin/admin-ajax.php?action=rest-nonce endpoint, rendering it ineffective as an authorization barrier.

The vulnerability allows authenticated users with low privileges (subscriber-level and above) to modify arbitrary posts and pages, including changing content and ownership. This can lead to unauthorized content manipulation and potential privilege escalation within the WordPress site. There is no impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles and permissions to trusted users only and monitor for unauthorized content changes. Since the wp_rest nonce does not provide effective authorization, additional access control measures should be implemented if possible.