CVE-2024-6698highCWE-862

CVE-2024-6698: falha de alta gravidade em roxnor FundEngine – Donation and Crowdfunding…

FundEngine – Donation and Crowdfunding Platform <= 1.7.0 - Authenticated (Subscriber+) Privilege Escalation

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar FundEngine – Donation and Crowdfunding Platform

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 0.4%
The FundEngine plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.0. This is due to the plugin not properly verifying user meta updated through the update_user_meta function. This makes it possible for authenticated attackers, with subscriber-level access and above, to update their user meta which can be leveraged to update their capabilities to gain administrator access.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
roxnor · FundEngine – Donation and Crowdfunding Platform
CVEs relacionadas — roxnor FundEngine – Donation and Crowdfunding…

No mesmo produto, das mais perigosas para as menos.

CVE-2026-75930MEDIUMFundEngine <= 1.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'campaign_post' ParameterEPSS 0.4%CVE-2026-76063MEDIUMFundEngine <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wfp_featured_video_url' ParameterEPSS 0.3%