CVE-2026-14859

WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Creation via Missing Authorization

The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts despite not being granted that permission.

Affected

WP Crowdfunding

CVSS v3.1 CNA

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS

0.25% chance of exploitation in the next 30 days, 16th percentile

Published

2026-08-12

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/5bc0f382-7655-4f19-a057-917d49dae6e2/

References

• CVE Record
• NVD entry