CVE-2026-14858

WP Crowdfunding < 2.2.1 - Subscriber+ Order Data Disclosure via IDOR

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store.

Affected

WP Crowdfunding

CVSS v3.1 CNA

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.27% chance of exploitation in the next 30 days, 18th percentile

Published

2026-08-12

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/59022a2a-29b2-485a-9512-cd0a27b6492b/

References

• CVE Record
• NVD entry