CVE-2026-85126: CWE-269 Improper Privilege Management in Crowdfundly

CVE-2026-85126 describes a privilege escalation vulnerability in the Crowdfundly WordPress plugin through version 2.2.2. The plugin fails to enforce capability checks on some AJAX actions, enabling users assigned low privileged roles within the plugin to grant themselves the administrator role or arbitrary capabilities. This improper privilege management (CWE-269) can result in a full site compromise if exploited.

Exploitation of this vulnerability allows an attacker with a low privileged role in the Crowdfundly plugin to escalate their privileges to administrator level or acquire arbitrary capabilities. This effectively enables full control over the affected WordPress site, including potential unauthorized access, modification, or deletion of site content and settings.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles and permissions carefully and monitor for suspicious privilege escalations related to Crowdfundly plugin AJAX actions.