CVE-2026-14858 — WP Crowdfunding < 2.2.1 - Subscriber+ Order Data Disclosure via IDOR

CVE-2026-14858

WP Crowdfunding < 2.2.1 - Subscriber+ Order Data Disclosure via IDOR PUBLISHED

Description (CNA)

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store.

Affected (CNA)

Vendor / product	Versions
Unknown / WP Crowdfunding	affected 0 before 2.2.1

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/59022a2a-29b2-485a-9512-cd0a27b6492b/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.