---
id: CVE-2026-85126
title: >-
  The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks
  on some of its AJAX actions, allowing users holding one of its own low
  privileged roles to grant themselves the administrator role or arbitrary
  capabilities, …
summary: >-
  The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks
  on some of its AJAX actions, allowing users holding one of its own low
  privileged roles to grant themselves the administrator role or arbitrary
  capabilities, …
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-269
published: '2026-10-11'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T20:36:00.850'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85126'
references:
  - url: 'https://wpscan.com/vulnerability/fc5c0492-9478-4fb3-b162-e9682b95364f/'
    label: contact@wpscan.com
tags:
  - nvd
  - cve.org
epss: 0.00307
epssPercentile: 0.234
ingestedAt: '2026-10-11T08:44:24.720Z'
product: Crowdfundly
affected:
  - Crowdfundly <= 2.2.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-11T11:23:52.896566Z'
---

## Overview

The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, allowing users holding one of its own low privileged roles to grant themselves the administrator role or arbitrary capabilities, leading to a full site takeover.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.