WordPress Plugin Vulnerabilities

WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Update Modification via IDOR

Description

The plugin does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns.

Proof of Concept

Affects Plugins

Plugin icon
wp-crowdfunding
Fixed in 2.2.1

References

CVE
CVE-2026-14857

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Sanjorn Keeratirungsan
Submitter
Sanjorn Keeratirungsan
Verified
Yes
WPVDB ID
2bd55d2f-2bcc-4c55-94cb-b6df929a7a3a

Timeline

Publicly Published
2026-08-10 (about 2 days ago)
Added
2026-08-10 (about 1 day ago)
Last Updated
2026-08-10 (about 1 day ago)

Other

Published
Title
Published
2024-10-16
Title
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors < 4.7.2 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary User Email Update and Account Takeover
Published
2025-05-05
Title
User Registration & Membership – Custom Registration Form, Login Form, and User Profile < 4.2.2 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion
Published
2026-01-16
Title
Frontend File Manager Plugin < 23.6 - Unauthenticated Insecure Direct Object Reference
Published
2026-08-03
Title
Slim SEO < 4.9.11 - Contributor+ Arbitrary Post Meta Disclosure
Published
2025-04-01
Title
JS Job Manager <= 2.0.2 - Authenticated Insecure Direct Object Reference