4.3
Moyenne
CVE-2026-14858 The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details,…
Description
The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| WP Crowdfunding 2.2 | premières → < 2.2.1 | 2.2.1 |
Autres CVE de WP Crowdfunding
Les 6 CVE de WP Crowdfunding →
CVE-2026-14859
The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX…
4.3
Moyenne
CVE-2026-14857
The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update…
4.3
Moyenne
CVE-2023-6163
The WP Crowdfunding WordPress plugin before 2.1.10 does not sanitise and escape some of its settings, which could…
4.8
Moyenne
CVE-2023-6161
The WP Crowdfunding WordPress plugin before 2.1.9 does not sanitise and escape a parameter before outputting it back…
6.1
Moyenne