---
id: CVE-2026-85126
title: >-
  The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks
  on some of its AJAX actions, allowing users holding one of its own low
  privileged roles to grant themselves the administrator role or arbitrary
  capabilities, …
summary: >-
  The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks
  on some of its AJAX actions, allowing users holding one of its own low
  privileged roles to grant themselves the administrator role or arbitrary
  capabilities, …
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-269
published: '2026-10-11'
updated: '2026-10-11'
sourceUpdated: '2026-10-11T12:17:24.370'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85126'
references:
  - url: 'https://wpscan.com/vulnerability/fc5c0492-9478-4fb3-b162-e9682b95364f/'
    label: contact@wpscan.com
tags:
  - nvd
ingestedAt: '2026-10-11T08:44:24.720Z'
epss: 0.00142
epssPercentile: 0.03017
---

## Overview

The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, allowing users holding one of its own low privileged roles to grant themselves the administrator role or arbitrary capabilities, leading to a full site takeover.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.