What’s Vulnerable › Vulnerabilities
CVE-2026-85126: Crowdfundly <= 2.2.2 - Crowdfundly Manager+ Privilege Escalation
- Severity: high (CVSS 7.2 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-11 · updated 2026-10-13
- Weakness: CWE-269
Description
The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, allowing users holding one of its own low privileged roles to grant themselves the administrator role or arbitrary capabilities, leading to a full site takeover.
Affected products
- Crowdfundly: through 2.2.2
References
Get alerted when CVE-2026-85126 or the next vulnerability affects your stack