The plugin fails to verify that a user has permission before performing the post modification action. As a result, any logged‑in actor with subscriber level access or higher can send a REST request with the campaign_post parameter to change a target post's title, content, and even the post_author, bypassing the built‑in wp_kses_post filter. This allows an attacker to overwrite page or post content and seize ownership of the page or post. The weakness is a missing authorization check, identified as CWE-862.

All installations of the roxnor FundEngine – Donation and Crowdfunding Platform plugin for WordPress that are version 1.8.1 or earlier are affected. Any deployment of 1.8.1 or older remains exposed.

The CVSS score is 4.3, indicating moderate severity. EPSS is not available and the issue is not listed in CISA KEV, suggesting that large‑scale exploitation is not yet confirmed. An authenticated user can obtain the required REST nonce trivially via /wp-admin/admin-ajax.php?action=rest-nonce; no additional authorization barrier exists. Therefore, once the user is logged in, the attacker can construct a request to the plugin’s REST endpoint with the campaign_post parameter, leading to unauthorized content modification. The attack vector is likely Local API (authenticated user), with no requirement for elevated privileges beyond subscriber level.