CVE-2026-14857

Deferred Deferred - Pending Action

Authenticated Users Can Modify Campaign Update History in WP Crowdfunding Plugin

Publication date: 2026-08-12

Last updated on: 2026-08-26

Assigner: WPScan

Description

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-26

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-31

NVD

CVE-2026-14857

EUVD

EUVD-2026-57078

Affected Vendors & Products

Vendor	Product	Version / Range
wp_crowdfunding	wp_crowdfunding	to 2.2.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This is an Insecure Direct Object Reference (IDOR) vulnerability in the WP Crowdfunding WordPress plugin before version 2.2.1. It allows authenticated users with Subscriber-level access or higher to modify campaign update histories and send notification emails to backers without verifying ownership of the campaign.

Detection Guidance

Check the installed version of the WP Crowdfunding plugin. If it is below 2.2.1, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the version.

Impact Analysis

An attacker could alter another user's campaign details, potentially misleading backers or causing financial harm. Since notification emails are triggered, backers might receive false updates about campaigns they supported.

Compliance Impact

This vulnerability could lead to unauthorized changes in user data, potentially violating GDPR's data integrity principles or HIPAA's requirements for protecting sensitive information. It may result in non-compliance if user data is altered without consent.

Mitigation Strategies

Update the WP Crowdfunding plugin to version 2.2.1 or later immediately. Remove or restrict Subscriber-level access if not required to reduce attack surface. Monitor campaign update histories for unauthorized changes.

Hi! I’m here to help you understand CVE-2026-14857. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70