CVE-2026-14858
WP Crowdfunding < 2.2.1 - Subscriber+ Order Data Disclosure via IDOR
- State
- Published
- Severity
- 4.3 Medium
- Published
- Aug 12, 2026
- Updated
- Aug 12, 2026
- Reserved
- Jul 6, 2026
Description
The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | CISA-ADP |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
WP CrowdfundingUnknown |
|
References
- https://wpscan.com/vulnerability/59022a2a-29b2-485a-9512-cd0a27b6492b/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.