WordPress Plugin Vulnerabilities

WP Crowdfunding < 2.2.1 - Subscriber+ Order Data Disclosure via IDOR

Description

The plugin does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store.

Proof of Concept

Affects Plugins

Plugin icon
wp-crowdfunding
Fixed in 2.2.1

References

CVE
CVE-2026-14858

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Sajjad Haqi
Submitter
Sajjad Haqi
Verified
Yes
WPVDB ID
59022a2a-29b2-485a-9512-cd0a27b6492b

Timeline

Publicly Published
2026-08-10 (about 2 days ago)
Added
2026-08-10 (about 1 day ago)
Last Updated
2026-08-10 (about 1 day ago)

Other

Published
Title
Published
2024-11-20
Title
Button Block – Get fully customizable & multi-functional buttons < 1.1.5 - Authenticated (Contributor+) Post Disclosure
Published
2026-02-13
Title
Scheduler Widget <= 0.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Event Modification
Published
2020-10-15
Title
Realia <= 1.4 - Unauthenticated IDOR leading to Arbitrary Post Deletion
Published
2026-06-11
Title
Fluent Forms < 6.2.5 - Form Manager+ Cross-Form Submission Entry Deletion via IDOR
Published
2026-08-03
Title
Slim SEO < 4.9.11 - Contributor+ Arbitrary Post Meta Disclosure