4.3
Medium
CVE-2026-14858 The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details,…
Description
The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WP Crowdfunding 2.2 | earliest → < 2.2.1 | 2.2.1 |
Other CVEs of WP Crowdfunding
The 6 CVEs of WP Crowdfunding →
CVE-2026-14859
The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX…
4.3
Medium
CVE-2026-14857
The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update…
4.3
Medium
CVE-2023-6163
The WP Crowdfunding WordPress plugin before 2.1.10 does not sanitise and escape some of its settings, which could…
4.8
Medium
CVE-2023-6161
The WP Crowdfunding WordPress plugin before 2.1.9 does not sanitise and escape a parameter before outputting it back…
6.1
Medium