What’s Vulnerable › Vulnerabilities
CVE-2026-14858: WP Crowdfunding < 2.2.1 - Subscriber+ Order Data Disclosure via IDOR
- Severity: medium (CVSS 4.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-12 · updated 2026-08-26
- Weakness: CWE-639
Description
The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store.
Affected products
- themeum WP Crowdfunding: before 2.2.1 — fixed in 2.2.1
How to fix
Upgrade to a fixed version: themeum WP Crowdfunding 2.2.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-14858 or the next vulnerability affects your stack