[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fpOSAybgFwVTXLeOnkYdpHIrYJMKp4ZUI6b-qqB0WYwM":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":34,"research_started_at":35,"research_completed_at":36,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":37},"CVE-2026-57406","fundengine-donation-and-crowdfunding-platform-missing-authorization","FundEngine – Donation and Crowdfunding Platform \u003C= 1.7.6 - Missing Authorization","The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.7.6. This makes it possible for unauthenticated attackers to perform an unauthorized action.","wp-fundraising-donation",null,"\u003C=1.7.6","1.7.7","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-07-08 00:00:00","2026-07-14 19:42:40",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F4419f975-fb8d-4603-9e16-122fbd7cfdae?source=api-prod",7,[22,23,24,25,26,27,28,29],"apps\u002Fcontent.php","apps\u002Fdonation-cpt.php","apps\u002Felementor\u002Felements.php","apps\u002Felementor\u002Fwidgets\u002Fdonate.php","apps\u002Felementor\u002Fwidgets\u002Flisting.php","apps\u002Ffeatured.php","apps\u002Fform-settings.php","apps\u002Ffundraising-cpt.php","researched",false,3,"# Exploitation Research Plan - CVE-2026-57406\n\n## 1. Vulnerability Summary\nThe **FundEngine – Donation and Crowdfunding Platform** plugin (versions \u003C= 1.7.6) contains a **Missing Authorization** vulnerability. The flaw exists in the `WfpFundraising\\Apps\\Content` class, specifically within the `wfp_donate_return_message` function (and potentially `wfp_init_rest`) hooked to `init`. \n\nThe plugin fails to perform a capability check or verify the authenticity of requests (e.g., via a secure token or gateway signature) when processing donation return messages or custom \"REST\" actions. This allows unauthenticated attackers to perform unauthorized actions, such as marking a donation as \"completed\" without actual payment or modifying donation metadata.\n\n## 2. Attack Vector Analysis\n- **Endpoint**: Frontend site root (`\u002F`) or `admin-ajax.php`.\n- **Hook**: `init` (via `wfp_donate_return_message`) or `wp_ajax_nopriv_*`.\n- **Authentication**: None (Unauthenticated).\n- **Parameters**: \n    - `wfp-action`: The action trigger (e.g., `wfp_paypal_success`, `return`, or `wfp_init_rest` handlers).\n    - `donation_id` \u002F `id`: The ID of the `wfp_donation` post to modify.\n    - `status`: The target status (e.g., `completed`, `success`).\n- **Preconditions**: A valid `wfp_donation` post must exist (usually created by initiating a donation).\n\n## 3. Code Flow\n1. **Entry Point**: `apps\u002Fcontent.php` registers the hook:\n   ```php\n   add_action( 'init', array( $this, 'wfp_donate_return_message' ) ); \u002F\u002F Line 65\n   ```\n2. **Execution**: Every request to the WordPress site triggers `init`. The `wfp_donate_return_message` function checks for specific `$_GET` or `$_POST` parameters.\n3. **Sink**: The function identifies a `donation_id` from the request and uses `update_post_meta()` or `wp_update_post()` to change the status of the `wfp_donation` post type.\n4. **Missing Check**: The function lacks `current_user_can()` or a verification of a unique transaction hash\u002Fnonce from the payment provider (PayPal\u002FStripe), trusting the user-provided ID.\n\n## 4. Nonce Acquisition Strategy\nThis vulnerability typically involves the payment return logic, which often bypasses standard WordPress nonces to accommodate external callbacks. However, if the vulnerability is inside an AJAX handler:\n\n1. **Shortcode Page**: The plugin enqueues scripts on pages containing the `[wfp-forms]` or `[wfp_fundraising_form]` shortcodes.\n2. **Variable Identification**: Look for `wp_localize_script` in `apps\u002Fcontent.php` (inside `wfp_donation_css_loader_public`).\n3. **Extraction**:\n   - Create a page: `wp post create --post_type=page --post_status=publish --post_content='[wfp-forms]'`\n   - Navigate to the page.\n   - Use `browser_eval` to extract: `window.wfp_fundraising_params?.nonce` or `window.wfp_fundraising_data?.nonce`.\n4. **Bypass**: If the logic is in `wfp_donate_return_message` (the `init` hook), it likely **does not require a nonce**, as it is designed for payment gateway redirects.\n\n## 5. Exploitation Strategy\n### Step 1: Identify a Target Donation\nAn attacker needs a valid `donation_id`. This can be obtained by starting a donation as a guest or by enumerating IDs if the `wfp_donation` post type is `publicly_queryable`.\n\n### Step 2: Trigger Unauthorized Status Update\nSend a GET request to the site root simulating a successful payment return.\n\n**Request:**\n- **URL**: `http:\u002F\u002Flocalhost:8080\u002F`\n- **Method**: `GET`\n- **Parameters**:\n    - `wfp-action`: `wfp_paypal_success` (inferred from typical FundEngine return logic)\n    - `donation_id`: `[TARGET_ID]`\n    - `status`: `completed`\n\n**Tool Call (example)**:\n```javascript\nhttp_request({\n    method: \"GET\",\n    url: \"http:\u002F\u002Flocalhost:8080\u002F?wfp-action=wfp_paypal_success&donation_id=123&status=completed\"\n})\n```\n\n## 6. Test Data Setup\n1. **Create Campaign**:\n   ```bash\n   wp post create --post_type=wp-fundraising --post_title=\"Save the Whales\" --post_status=publish\n   ```\n2. **Create Pending Donation**:\n   Use the `wfp_donation` post type defined in `apps\u002Fdonation-cpt.php`:\n   ```bash\n   wp post create --post_type=wfp_donation --post_title=\"Guest Donation\" --post_status=publish --post_author=0\n   # Note the returned ID (e.g., 123)\n   wp post primary-setup 123 --meta_input='{\"_wfp_donation_status\":\"pending\"}'\n   ```\n3. **Place Shortcode**:\n   ```bash\n   wp post create --post_type=page --post_title=\"Donate Now\" --post_content='[wfp-forms]' --post_status=publish\n   ```\n\n## 7. Expected Results\n- The server responds with a `200 OK` or a redirect to the success page (defined by `wfp-success` shortcode).\n- The `wfp_donation` post meta or status is updated without the attacker having performed a transaction.\n\n## 8. Verification Steps\nVerify the donation status via WP-CLI:\n```bash\n# Check the post meta for the donation status\nwp post meta get [ID] _wfp_donation_status\n\n# Or check the overall post status if used\nwp post get [ID] --field=post_status\n```\nSuccessful exploitation is confirmed if the status changed from `pending` to `completed` or `success`.\n\n## 9. Alternative Approaches\nIf the `init` hook requires a more complex payload, investigate `apps\u002Fcontent.php` for the `wfp_init_rest` function:\n1. **Action Identification**: Search for `$_REQUEST['wfp-action']` or `$_GET['action']` inside the body of `wfp_init_rest`.\n2. **Parameter Fuzzing**: If `wfp_init_rest` handles a `delete` action, attempt:\n   `\u002F?wfp-action=wfp_delete_donation&id=[ID]`\n3. **AJAX Testing**: Check if `wp_ajax_nopriv_featured_video_get_data` in `apps\u002Ffeatured.php` allows for unauthorized meta retrieval or updates by providing a different `post_id` than intended.","gemini-3-flash-preview","2026-07-16 15:26:00","2026-07-16 15:27:38",{"type":38,"vulnerable_version":39,"fixed_version":11,"vulnerable_browse":40,"vulnerable_zip":41,"fixed_browse":42,"fixed_zip":43,"all_tags":44},"plugin","1.7.6","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwp-fundraising-donation\u002Ftags\u002F1.7.6","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwp-fundraising-donation.1.7.6.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwp-fundraising-donation\u002Ftags\u002F1.7.7","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwp-fundraising-donation.1.7.7.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwp-fundraising-donation\u002Ftags"]