CVE-2022-0788: WP Fundraising Donation and Crowdfunding Platform < 1.5.0 - Unauthenticated SQLi

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-06-08 · updated 2026-06-17
Weakness: CWE-89

Description

The WP Fundraising Donation and Crowdfunding Platform WordPress plugin before 1.5.0 does not sanitise and escape a parameter before using it in a SQL statement via one of it's REST route, leading to an SQL injection exploitable by unauthenticated users

Affected products

Roxnor FundEngine: before 1.5.0 — fixed in 1.5.0

How to fix

Upgrade to a fixed version: Roxnor FundEngine 1.5.0. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/fbc71710-123f-4c61-9796-a6a4fd354828
https://wpscan.com/vulnerability/fbc71710-123f-4c61-9796-a6a4fd354828

Get alerted when CVE-2022-0788 or the next vulnerability affects your stack