The FundPress WordPress donation plugin contains a missing authorization check in its donate_action_status AJAX handler. When a request is received from an unauthenticated user, the function validates only the schema parameter and the presence of POST variables without verifying nonce tokens, user capabilities, or donation ownership. This allows an attacker to supply any numeric donation ID—which is sequential and easily enumerated—to change the status of that donation to any value, such as completed, pending, or cancelled. The change can trigger email notifications and other side effects associated with the status change, potentially creating confusion or financial inaccuracies.

The vulnerability affects the FundPress plugin for WordPress in versions up to and including 2.0.8. The issue exists in the code by which the plugin registers the donate_action_status function as a wp_ajax_nopriv endpoint, making it reachable to any visitor of the site. No other vendor or product is impacted by this specific flaw.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting that public exploitation is not yet confirmed. Attackers can exploit the flaw by sending HTTP POST requests to the donate_action_status endpoint from any network. Since the donation IDs are simple, sequential integers, enumeration is trivial, and the exploit requires no authentication or additional credentials. While the risk is moderate, the potential for financial impact or administrative misrepresentation warrants timely remediation.