CVE-2026-73189

The WordPress WP Crowdfunding plugin (versions below 2.2.1) has an IDOR vulnerability allowing authenticated subscribers to access other users' data via direct object references. Patchstack reports a CVSS 6.5 (MEDIUM) with HIGH confidentiality impact. Exploitation in the wild is not documented; u...

CVE-2026-73189 WordPress WP Crowdfunding plugin < 2.2.1 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in WP Crowdfunding 2.2.1 versions...

CVE-2026-73189

Subscriber Insecure Direct Object References IDOR in WP Crowdfunding 2.2.1 versions...

EUVD-2026-60939

Subscriber Insecure Direct Object References IDOR in WP Crowdfunding 2.2.1 versions...

WordPress WP Crowdfunding plugin < 2.2.1 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Jakub Herman in WordPress Plugin WP Crowdfunding versions 2.2.1...

CVE-2026-14859

The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts despite not being granted that permission...

CVE-2026-14858

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store...

CVE-2026-14857

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns...

CVE-2026-14859

The CVE-2026-14859 affects WP Crowdfunding

CVE-2026-14859

The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts despite not being granted that permission...

CVE-2026-14858 WP Crowdfunding < 2.2.1 - Subscriber+ Order Data Disclosure via IDOR

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store...

CVE-2026-14858

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store...

EUVD-2026-57079

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store...

CVE-2026-14859 WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Creation via Missing Authorization

The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts despite not being granted that permission...

EUVD-2026-57080

The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts despite not being granted that permission...

CVE-2026-14858

The CVE affects the WP Crowdfunding WordPress plugin prior to version 2.2.1. It fails to verify order ownership when returning order details, enabling any authenticated user (e.g., Subscribers) to read personal data of any WooCommerce order and enumerate all orders. Root cause is an insecure acce...

CVE-2026-14857

The WP Crowdfunding WordPress plugin is affected by an IDOR vulnerability in versions before 2.2.1. The issue arises because the plugin does not verify campaign ownership when allowing updates to a campaign’s history and sending notification emails to backers. As a result, any authenticated user ...

CVE-2026-14857 WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Update Modification via IDOR

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns...

CVE-2026-14857

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns...

PT-2026-71003

Name of the Vulnerable Software and Affected Versions WP Crowdfunding WordPress plugin versions prior to 2.2.1 Description Authenticated users, including those with Subscriber roles, can modify the update history of campaigns they do not own and trigger notification emails to backers because the...