CVE Catalog
CVE-2026-32470
CriticalCVSS 9.8Summary
An unauthenticated attacker can perform PHP Object Injection in FundEngine versions up to 1.7.9.
Risk Assessment
Potential for dangerous server-side operations, including remote code execution if suitable gadgets are available.
Recommendation
Update the FundEngine plugin to a version newer than 1.7.9.
Original NVD description (English source)
Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.