CVE-2026-73189: WordPress WP Crowdfunding plugin < 2.2.1 - Insecure Direct Object References (IDOR) vulnerability
Subscriber Insecure Direct Object References (IDOR) in WP Crowdfunding < 2.2.1 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WP Crowdfunding pluginto a version that resolves this vulnerability.Fixed in 2.2.1
Event History
Frequently Asked Questions
What level of access does an attacker need?
WP Crowdfunding versions earlier than 2.2.1 are affected. The issue is described as being exploitable by Subscriber-level users, so it requires an authenticated account with that role or equivalent low-level access.
Can this be exploited remotely without victim interaction?
The vector is network-accessible and requires no user interaction, according to the supplied CVSS data. A low-privileged authenticated user can potentially access information they should not be authorized to access through insecure object references.
What is the remediation?
Update WP Crowdfunding to version 2.2.1 or later. The provided data does not identify a workaround for installations that cannot be updated immediately.