CVE-2024-6698

The FundEngine plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.0. This is due to the plugin not properly verifying user meta updated through the update_user_meta function. This makes it possible for authenticated attackers, with subscriber-level access and above, to update their user meta which can be leveraged to update their capabilities to gain administrator access.

• CWE-862
• CWE-862

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3128099%40wp-fundraising-donation%2Ftrunk&old=3072093%40wp-fundraising-donation%2Ftrunk&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/2ec6cf42-291b-452d-ad14-80ae1cd5ec5c?source=cveThird Party Advisory

Published

Aug 1, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-6692The Easy Digital Downloads – Sell Digital Files & Subscripti…3.1
• CVE-2024-6693The wccp-pro WordPress plugin before 15.3 does not sanitise …4.8
• CVE-2024-6694The WP Mail SMTP plugin for WordPress is vulnerable to infor…2.7
• CVE-2024-6695it's possible for an attacker to gain administrative access …9.8
• CVE-2024-6696The product implements access controls via a policy or other…4.9
• CVE-2024-6697The product does not handle or incorrectly handles when it h…6.5
• CVE-2024-6699Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2024-6700Pega Platform versions 8.1 to Infinity 24.1.2 are affected b…4.8
• CVE-2024-6701Pega Platform versions 8.1 to Infinity 24.1.2 are affected b…4.8
• CVE-2024-6702Pega Platform versions 8.1 to Infinity 24.1.2 are affected b…4.8
• CVE-2024-6703The Contact Form Plugin by Fluent Forms for Quiz, Survey, an…5.4
• CVE-2024-6704The Comments – wpDiscuz plugin for WordPress is vulnerable t…6.1