Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: WP Crowdfunding 2.2.1 Clear all filters
TI-2026-12527 CVE-2026-14859 · GHSA-j969-3gcr-g846

WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Creation via Missing Authorization

Priority MEDIUM 53

The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts d…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00254 Published 2026-08-12 Fixed in 2.2.1 CWE-284
TI-2026-12526 CVE-2026-14858 · GHSA-36jj-jw5h-6rp8

WP Crowdfunding < 2.2.1 - Subscriber+ Order Data Disclosure via IDOR

Priority MEDIUM 53

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order an…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0027 Published 2026-08-12 Fixed in 2.2.1 CWE-639
TI-2026-12525 CVE-2026-14857 · GHSA-fmm2-vv76-h6wg

WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Update Modification via IDOR

Priority MEDIUM 53

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users s…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00254 Published 2026-08-12 Fixed in 2.2.1 CWE-639