CVE-2026-14858

The CVE affects the WP Crowdfunding WordPress plugin prior to version 2.2.1. It fails to verify order ownership when returning order details, enabling any authenticated user (e.g., Subscribers) to read personal data of any WooCommerce order and enumerate all orders. Root cause is an insecure acce...