[ CVE-2026-85126 · Published 11 Oct 2026 ]
Vulnerability in Unknown Crowdfundly
CVSS 7.2
EPSS <1%No fix listed yet
[ Description ]Official description
The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, allowing users holding one of its own low privileged roles to grant themselves the administrator role or arbitrary capabilities, leading to a full site takeover.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.