Skip to content
Sign in
4.3 Medium

CVE-2026-14857 The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update…

Description

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns.

Affected products and versions

Product Affected versions Fixed in
WP Crowdfunding 2.2 earliest → < 2.2.1 2.2.1

Other CVEs of WP Crowdfunding

The 6 CVEs of WP Crowdfunding →
CVE-2026-14858 The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details,… 4.3 Medium CVE-2026-14859 The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX… 4.3 Medium CVE-2023-6163 The WP Crowdfunding WordPress plugin before 2.1.10 does not sanitise and escape some of its settings, which could… 4.8 Medium CVE-2023-6161 The WP Crowdfunding WordPress plugin before 2.1.9 does not sanitise and escape a parameter before outputting it back… 6.1 Medium
Track this CVE