CVE-2026-14858
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details. Any authenticated users such as Subscribers can read the personal data of any WooCommerce order and enumerate every order in the store.
Risk Assessment
Serious customer privacy breach, including personal data and order details. This can lead to identity theft and GDPR violations.
Recommendation
Update the WP Crowdfunding plugin to version 2.2.1 or later. Implement ownership checks on order queries.
Original NVD description (English source)
The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store.