WordPress Crowdfundly Plugin Missing Capability Checks

The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, allowing users holding one of its own low privileged roles to grant themselves the administrator role or arbitrary capabilities, leading to a full site takeover.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Crowdfundly WordPress plugin through version 2.2.2 contains a critical privilege escalation vulnerability stemming from inadequate capability checks on AJAX actions. This flaw allows any user with low-privileged roles (such as contributor or subscriber) to invoke administrative functions without proper authorization, ultimately granting themselves administrator role or arbitrary capabilities. The vulnerability is particularly dangerous because WordPress sites often have numerous contributors and editors who should never access administrative functions. Any installation running the affected plugin versions is vulnerable to complete site takeover, making this a high-impact threat affecting the confidentiality, integrity, and availability of WordPress deployments.

Casky's 224 matched skills map this vulnerability to MITRE ATT&CK technique TA0004 (Privilege Escalation), enabling practitioners to detect the attack patterns through Claude AI's extended reasoning capabilities. Practitioners using Casky would identify suspicious indicators including: unauthorized AJAX requests modifying user role metadata, low-privileged accounts suddenly acquiring administrator capabilities, unexpected capability additions in user meta tables, and unusual administrative action logs originating from non-admin sessions. The platform's skill coverage would help security teams recognize the signature patterns of capability bypass attempts, correlate them with the Crowdfundly plugin's known AJAX endpoints, and distinguish legitimate administrative actions from privilege escalation exploitation attempts, allowing for rapid detection and response before full site compromise occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-85126.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-85126

Casky has 224 skills that investigate the attack patterns behind CVE-2026-85126. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn