WordPress Plugin Vulnerabilities

WP Crowdfunding < 2.2.1 - Unauthenticated Insecure Direct Object Reference

Description

The WP Crowdfunding plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to 2.2.1 (exclusive) due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
wp-crowdfunding
Fixed in 2.2.1

References

CVE
CVE-2026-73189
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/09b68ffe-f8b2-4cde-b36e-b14da58d0bca

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (Medium)

Miscellaneous

Original Researcher
Jakub Herman
Verified
No
WPVDB ID
86c3f8ac-4cbd-4249-99ff-f12b41f86193

Timeline

Publicly Published
2026-08-14 (about 10 days ago)
Added
2026-08-20 (about 3 days ago)
Last Updated
2026-08-20 (about 3 days ago)

Other

Published
Title
Published
2024-07-25
Title
ApplyOnline – Application Form Builder and Manager < 2.6.3 - Unauthenticated Application File Access
Published
2024-05-15
Title
Tutor LMS – eLearning and online course solution < 2.7.1 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Course Deletion
Published
2026-07-13
Title
Essential Addons for Elementor - Lite < 6.6.10 - Unauthenticated Draft/Private WooCommerce Product Disclosure via Compare Table
Published
2025-05-19
Title
WP Job Portal < 2.3.3 - Unauthenticated Insecure Direct Object Reference
Published
2026-05-19
Title
Photo Gallery, Sliders, Proofing and Themes < 4.2.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Image Deletion via REST API