CVE-2026-85126

Crowdfundly <= 2.2.2 - Crowdfundly Manager+ Privilege Escalation

The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, allowing users holding one of its own low privileged roles to grant themselves the administrator role or arbitrary capabilities, leading to a full site takeover.

Affected

Crowdfundly

CVSS v3.1 CNA

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.32% chance of exploitation in the next 30 days, 23rd percentile

Published

2026-10-11

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/fc5c0492-9478-4fb3-b162-e9682b95364f/

References

• CVE Record
• NVD entry