CVE-2026-57406 · Symaro Security Advisory

Description

Missing Authorization vulnerability in Roxnor FundEngine wp-fundraising-donation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FundEngine: from n/a through <= 1.7.6.

Severity (CVSS)

Base score	6.5
Severity	Medium
Version	CVSS 3.1
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Provided by	CNA

Weaknesses

CWE-862 — Missing Authorization

Affected products

Vendor	Product	Versions
Roxnor	FundEngine	0 to <=1.7.6

References

https://patchstack.com/database/Wordpress/Plugin/wp-fundraising-donation/vulnerability/wordpress-fundengine-plugin-1-7-6-broken-access-control-vulnerability?_s_id=cve (vdb-entry)

Authoritative sources

This page is a snapshot. For the latest enrichment and updates, view the record on CVE.org or the NVD.

Generated from the official CVE List on 14 Jul 2026 07:01 UTC.