CVE-2026-14858

Deferred Deferred - Pending Action

Unauthenticated Order Data Exposure in WP Crowdfunding WordPress Plugin

Publication date: 2026-08-12

Last updated on: 2026-08-26

Assigner: WPScan

Description

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-26

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-31

NVD

CVE-2026-14858

EUVD

EUVD-2026-57079

Affected Vendors & Products

Vendor	Product	Version / Range
wp_crowdfunding	wp_crowdfunding	to 2.2.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in the WP Crowdfunding WordPress plugin before version 2.2.1. It allows authenticated users with Subscriber-level access or higher to view personal data of any WooCommerce order and enumerate all orders because the plugin fails to verify order ownership before returning order details.

Detection Guidance

Check if the WP Crowdfunding plugin version is below 2.2.1. Use WordPress admin dashboard or run: wp plugin list | grep wp-crowdfunding. Alternatively, inspect plugin files for version details in /wp-content/plugins/wp-crowdfunding/

Impact Analysis

This vulnerability could allow unauthorized users to access sensitive personal data from WooCommerce orders, including customer information. Attackers could enumerate all orders in the store, potentially exposing private details like names, addresses, and payment information.

Compliance Impact

This vulnerability likely violates GDPR and other privacy regulations by exposing personal data without authorization. It could lead to non-compliance with data protection requirements, resulting in legal penalties and reputational damage for organizations handling sensitive customer information.

Mitigation Strategies

Update the WP Crowdfunding plugin to version 2.2.1 or later immediately. If updating is not possible, consider disabling the plugin until an update is applied. Review all WooCommerce orders for unauthorized access and restrict Subscriber-level access if necessary.

Hi! I’m here to help you understand CVE-2026-14858. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70