thimpress Vulnerabilities and Affected Products
Vulnerabilities associated with FundPress – WordPress Donation Plugin.
Products
Clear product- LearnPress – WordPress LMS Plugin for Create and Sell Online Courses37 vulnerabilities
- learnpress30 vulnerabilities
- WP Hotel Booking17 vulnerabilities
- WP Pipes9 vulnerabilities
- LearnPress Export Import5 vulnerabilities
- wp_hotel_booking5 vulnerabilities
- Eduma4 vulnerabilities
- LearnPress – Backup & Migration Tool4 vulnerabilities
- Thim Elementor Kit4 vulnerabilities
- LearnPress – WordPress LMS Plugin3 vulnerabilities
- Thim Core3 vulnerabilities
- RealPress2 vulnerabilities
- Sailing2 vulnerabilities
- Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor2 vulnerabilities
- WP Events Manager2 vulnerabilities
- BuilderPress1 vulnerability
- Course Builder1 vulnerability
- FundPress1 vulnerability
- FundPress – WordPress Donation Plugin1 vulnerability
- Ivy School1 vulnerability
- LearnPress – Course Review1 vulnerability
- LearnPress – Sepay Payment1 vulnerability
- Resca1 vulnerability
- Thim Blocks1 vulnerability
- wp_events_manager1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-4650MEDIUM | FundPress <= 2.0.8 - Missing Authorization to Unauthenticated Arbitrary Donation Status Modification via donate_action_status AJAX HandlerThe FundPress – WordPress Donation Plugin for WordPress is vulnerable to authorization bypass in versions up to and including 2.0.8. This is due to missing authorization and nonce verification in the donate_action_status() AJAX handler, which is registered to be accessible to unauthenticated users via wp_ajax_nopriv. The function only validates that the schema parameter equals 'donate-ajax' and that the required POST parameters are present, but fails to verify user capabilities, nonce tokens, or… CWE-862May 2, 2026 | CVSS5.3v3.1 | EPSS0.402% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |