A Cross‑Site Request Forgery (CSRF) flaw exists in the Roxnor FundEngine WordPress plugin that enables an attacker to provoke an authenticated user into sending requests to the plugin without the user’s consent. The vulnerability arises because the plugin fails to prevent or validate forged requests, potentially allowing unintended changes or actions through the user’s session. This weakness falls under CWE‑352 and affects the confidentiality, integrity, and availability of donation data if exploited.

The Roxnor FundEngine wp‑fundraising‑donation plugin, from the earliest available release through 1.7.3, is impacted. Any WordPress site running one of these versions is at risk. The vendor is listed as Roxnor:FundEngine.

The CVSS score of 4.3 suggest moderate severity, while the EPSS score of less than 1% indicates that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. The likely attack path involves a malicious site sending a forged request that the authenticated user unknowingly processes while logged into WordPress. Successful exploitation requires the target to be logged in with a role that can interact with the plugin’s functionality.