CVE-2026-14858: WP Crowdfunding < 2.2.1 - Subscriber+ Order Data Disclosure via IDOR
Published Aug 12, 2026
·Updated
The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store.
Affected Software
1 affected component
WP Crowdfunding WordPress plugin<2.2.1
Event History
Aug 12, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:17 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2026-14858?
CVE-2026-14858 has a risk score of 62, indicating a moderate severity vulnerability.
2
What does CVE-2026-14858 affect?
CVE-2026-14858 affects the WP Crowdfunding WordPress plugin versions prior to 2.2.1.
3
How do I fix CVE-2026-14858?
To remediate CVE-2026-14858, update the WP Crowdfunding plugin to version 2.2.1 or later.
4
What type of vulnerability is CVE-2026-14858?
CVE-2026-14858 is an IDOR (Insecure Direct Object Reference) vulnerability.
5
Who is impacted by CVE-2026-14858?
CVE-2026-14858 potentially impacts any authenticated users, such as subscribers, who can access WooCommerce order details.