The FundPress WordPress Donation Plugin up to version 2.0.8 contains an authorization bypass vulnerability in its donate_action_status() AJAX handler. This flaw allows unauthenticated attackers to modify donation statuses by exploiting missing authorization and nonce verification. Attackers can change donation states such as completed, pending, or cancelled by providing sequential donation IDs, potentially triggering unintended email notifications and side effects.