Medium severity · published Aug 12, 2026
CVE-2026-14858
WP Crowdfunding < 2.2.1 - Subscriber+ Order Data Disclosure via IDOR
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WC
WP Crowdfunding ·
before 2.2.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-14858
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-14858
wpscan.com
https://wpscan.com/vulnerability/59022a2a-29b2-485a-9512-cd0a27b6492b/
More from WP Crowdfunding
6.1
CVE-2023-6161
WP Crowdfunding < 2.1.9 - Reflected XSS
4.8
CVE-2023-6163
WP Crowdfunding < 2.1.10 - Admin+ Stored XSS
4.8
CVE-2023-5757
WP Crowdfunding < 2.1.8 - Admin+ Stored XSS
4.3
CVE-2026-14859
WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Creation via Missing Authorization
4.3
CVE-2026-14857
WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Update Modification via IDOR