CVE-2026-14859

The WP Crowdfunding WordPress plugin in versions before 2.2.1 is vulnerable to a missing authorization flaw. The plugin fails to verify the campaign-submission capability within one of its AJAX actions . This allows any authenticated user, such as those with the Subscriber role, to create crowdfu...