Skip to content
Sign in
4.3 Medium

CVE-2026-14859 The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX…

Description

The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts despite not being granted that permission.

Affected products and versions

Product Affected versions Fixed in
WP Crowdfunding 2.2 earliest → < 2.2.1 2.2.1

Other CVEs of WP Crowdfunding

The 6 CVEs of WP Crowdfunding →
CVE-2026-14858 The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details,… 4.3 Medium CVE-2026-14857 The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update… 4.3 Medium CVE-2023-6163 The WP Crowdfunding WordPress plugin before 2.1.10 does not sanitise and escape some of its settings, which could… 4.8 Medium CVE-2023-6161 The WP Crowdfunding WordPress plugin before 2.1.9 does not sanitise and escape a parameter before outputting it back… 6.1 Medium
Track this CVE