CVE-2026-85126: high-severity vulnerability in Crowdfundly
Crowdfundly <= 2.2.2 - Crowdfundly Manager+ Privilege Escalation
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 7.2epss 0.3%
The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, allowing users holding one of its own low privileged roles to grant themselves the administrator role or arbitrary capabilities, leading to a full site takeover.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · Crowdfundlypublic PoCs found — 1
cve_referencewpscan.com/vulnerability/fc5c0492-9478-4fb3-b162-e9682b95364f/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.