WordPress Plugin Vulnerabilities

Crowdfundly <= 2.2.2 - Crowdfundly Manager+ Privilege Escalation

Description

The plugin does not have capability checks on some of its AJAX actions, allowing users holding one of its own low privileged roles to grant themselves the administrator role or arbitrary capabilities, leading to a full site takeover.

Proof of Concept

Affects Plugins

Plugin icon
crowdfundly
No known fix

References

CVE
CVE-2026-85126

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Enrico Marcolini - Claudio Marchesini - Dottor Marc
Submitter
Enrico Marcolini - Claudio Marchesini - Dottor Marc
Submitter website
https://www.dottormarc.it
Verified
Yes
WPVDB ID
fc5c0492-9478-4fb3-b162-e9682b95364f

Timeline

Publicly Published
2026-10-09 (about 2 days ago)
Added
2026-10-09 (about 1 day ago)
Last Updated
2026-10-09 (about 1 day ago)

Other

Published
Title
Published
2026-09-15
Title
Choose User Role at Registration for WooCommerce < 1.3.3 - Unauthenticated Privilege Escalation via Registration Role Request
Published
2025-04-23
Title
Buddypress Force Password Change <= 0.1 - Subscriber+ Account Takeover via Password Update
Published
2025-11-10
Title
TNC Toolbox: Web Performance < 2.0.0 - Unauthenticated Privilege Escalation/cPanel Account Takeover
Published
2026-10-05
Title
Doctreat Core <= 1.7.0 - Unauthenticated Privilege Escalation
Published
2024-09-17
Title
Webo-facto < 1.41 - Unauthenticated Privilege Escalation