CVE-2026-14857: WP Crowdfunding Auth Bypass Vulnerability

CVE-2026-14857 Overview

CVE-2026-14857 affects the WP Crowdfunding WordPress plugin in versions prior to 2.2.1. The plugin fails to verify campaign ownership before allowing update history modifications and backer notification emails to be sent. Any authenticated user, including low-privileged Subscribers, can alter campaigns owned by other users. This is a broken access control flaw [CWE-284/CWE-862] that exposes crowdfunding campaign integrity and enables abuse of the backer notification system.

Critical Impact
Authenticated attackers with Subscriber-level access can tamper with campaign update history belonging to other users and trigger notification emails to their backers, undermining campaign integrity and enabling social engineering against backers.

Affected Products

WP Crowdfunding WordPress plugin versions prior to 2.2.1
WordPress sites accepting Subscriber-level registration with the plugin installed
Crowdfunding sites relying on WP Crowdfunding for campaign management

Discovery Timeline

2026-08-12 - CVE-2026-14857 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-14857

Vulnerability Analysis

The vulnerability resides in the WP Crowdfunding plugin's campaign update handler. The plugin exposes functionality that lets a campaign owner post update entries to a campaign's history and dispatch notification emails to backers. The endpoint checks that the requester is authenticated but does not check whether the requester actually owns the target campaign.

Because WordPress Subscriber accounts can often be created through open registration, the effective barrier to exploitation is minimal on many sites. An attacker registers or uses an existing low-privilege account, then submits a request specifying an arbitrary campaign identifier along with attacker-supplied update content.

The plugin processes the request, appends the update to the target campaign's history, and generates notification emails delivered to that campaign's backers under the identity of the legitimate campaign owner.

Root Cause

The root cause is a missing authorization check. The handler validates authentication and nonce state but omits an ownership comparison between the current user identifier and the campaign author. This is a classic Insecure Direct Object Reference pattern in which a server-side object identifier is trusted without verifying that the caller has rights to that object.

Attack Vector

Exploitation requires an authenticated session at the Subscriber role or higher. The attacker sends a crafted request to the campaign update endpoint with a target campaign ID that they do not own. The plugin accepts the request, writes the update, and emails backers. No user interaction from the campaign owner or backers is required. Refer to the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-14857

Indicators of Compromise

Campaign update history entries whose authoring user does not match the campaign owner in the WordPress database
Outbound backer notification emails triggered outside the campaign owner's normal session activity
Access log entries showing Subscriber-role accounts posting to WP Crowdfunding update endpoints
Sudden creation of new low-privilege user accounts followed by requests to plugin AJAX or REST routes

Detection Strategies

Audit the wp_posts and plugin-specific update tables for update records where the update author differs from the campaign author
Correlate WordPress user role with HTTP POST activity targeting WP Crowdfunding endpoints and flag Subscriber-role writes
Monitor mail transfer logs for bursts of backer notification emails not tied to owner sessions

Monitoring Recommendations

Enable WordPress audit logging for content modifications and user role activity across the plugin's endpoints
Alert on requests to plugin AJAX actions submitted by users below the Author role
Forward web server and PHP error logs to a centralized analytics platform for retention and correlation

How to Mitigate CVE-2026-14857

Immediate Actions Required

Update the WP Crowdfunding plugin to version 2.2.1 or later on all WordPress installations
Review campaign update history for unauthorized entries created before patching and remove them
Audit user accounts for unexpected Subscriber registrations tied to the exploitation window

Patch Information

The vendor addressed the issue in WP Crowdfunding version 2.2.1 by adding an ownership check before permitting update history modification and backer notifications. Administrators should apply the update through the WordPress plugin manager or by deploying the vendor-supplied package. See the WPScan Vulnerability Report for advisory details.

Workarounds

Disable open user registration or restrict the default role to prevent untrusted Subscriber account creation until patching
Deactivate the WP Crowdfunding plugin if immediate patching is not possible
Restrict access to plugin AJAX and REST endpoints at the web application firewall layer for non-owner users

bash

# Configuration example: disable open registration and force a safe default role in wp-config.php
define('DISALLOW_FILE_EDIT', true);
# In WordPress Settings > General, uncheck "Anyone can register"
# Or enforce via option:
wp option update users_can_register 0
wp option update default_role subscriber