CVE-2026-14857

The WP Crowdfunding WordPress plugin is affected by an IDOR vulnerability in versions before 2.2.1. The issue arises because the plugin does not verify campaign ownership when allowing updates to a campaign’s history and sending notification emails to backers. As a result, any authenticated user ...

CVE-2026-14857 WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Update Modification via IDOR

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns...

CVE-2026-55544 NextCRM has BOLA/IDOR in MCP Campaign Tools that Allows Cross-User Campaign Disclosure and Tampering

NextCRM is open-source customer relationship management CRM software. In version 0.12.1, the MCP campaign tools expose campaign read and write operations over the network using user-generated Bearer API tokens nxtc.... The application has an authorization model that restricts normal users to...

Annex Cloud Loyalty Experience Platform 安全漏洞

Loyalty Experience Platform is Annex Cloud's platform that combines best-in-class program management capabilities with powerful engagement modules A security vulnerability exists in Annex Cloud Loyalty Experience Platform versions prior to 2021.1.0.1, which can be exploited by an attacker to modi...