CVE-2026-14857: WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Update Modification via IDOR
The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin WP Crowdfundingto a version that resolves this vulnerability.Fixed in 2.2.1 - Compensating control
Limit access to the WordPress admin area (where authenticated users like Subscribers can act) to trusted user roles until the plugin is upgraded to 2.2.1.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14857?
CVE-2026-14857 has a risk rating of 52, indicating a medium severity level.
How do I fix CVE-2026-14857?
To fix CVE-2026-14857, update the WP Crowdfunding plugin to version 2.2.1 or later.
What impact does CVE-2026-14857 have on my site?
CVE-2026-14857 allows authenticated users, such as Subscribers, to modify other users' campaign updates without ownership verification.
Who is affected by CVE-2026-14857?
Any site using the WP Crowdfunding plugin version earlier than 2.2.1 is vulnerable to CVE-2026-14857.
Is CVE-2026-14857 being actively exploited?
There are currently no public reports indicating that CVE-2026-14857 is being actively exploited.