CVE-2026-14858

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store.

CVSS v3.1

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.20% chance of exploitation in the next 30 days, 9th percentile

Published

2026-08-12

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/59022a2a-29b2-485a-9512-cd0a27b6492b/

References

• CVE Record
• NVD entry

Related

• CVE-2026-14857
• CVE-2026-14859
• CVE-2026-14856
• CVE-2026-14860
• CVE-2026-14853
• CVE-2026-14861