WordPress Crowdfundly plugin <= 2.2.2 - Crowdfundly Manager+ Privilege Escalation vulnerability

Crowdfundly Manager+ Privilege Escalation vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin Crowdfundly versions = 2.2.2...

CVE-2026-85126

The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, allowing users holding one of its own low privileged roles to grant themselves the administrator role or arbitrary capabilities, leading to a full site takeover...

CVE-2026-85126 Crowdfundly <= 2.2.2 - Crowdfundly Manager+ Privilege Escalation

The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, allowing users holding one of its own low privileged roles to grant themselves the administrator role or arbitrary capabilities, leading to a full site takeover...

CVE-2026-85126 Crowdfundly <= 2.2.2 - Crowdfundly Manager+ Privilege Escalation

The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, allowing users holding one of its own low privileged roles to grant themselves the administrator role or arbitrary capabilities, leading to a full site takeover...

EUVD-2026-96765

The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, allowing users holding one of its own low privileged roles to grant themselves the administrator role or arbitrary capabilities, leading to a full site takeover...

CVE-2026-85126

The Crowdfundly WordPress plugin, in versions through 2.2.2 , is vulnerable to privilege escalation due to missing capability checks on certain AJAX actions . An attacker with a low-privileged role within the plugin can exploit this flaw to grant themselves administrator privileges or arbitrary c...

PT-2026-110039

Name of the Vulnerable Software and Affected Versions Crowdfundly WordPress plugin versions prior to 2.2.3 Description Insufficient capability checks on certain AJAX actions allow users with low-privileged roles to grant themselves the administrator role or arbitrary capabilities, which can resul...

CVE-2026-85126: Improper Privilege Management

The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, allowing users holding one of its own low privileged roles to grant themselves the administrator role or arbitrary capabilities, leading to a full site takeover...