CVE-2026-14858: WP Crowdfunding Information Disclosure

CVE-2026-14858 Overview

CVE-2026-14858 is an Insecure Direct Object Reference (IDOR) vulnerability in the WP Crowdfunding WordPress plugin before version 2.2.1. The plugin fails to verify order ownership before returning order details through its endpoints. Any authenticated user, including low-privileged Subscriber accounts, can read personal data from any WooCommerce order and enumerate every order in the store. The flaw is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Authenticated attackers with Subscriber-level access can enumerate all WooCommerce orders and harvest customer personal data, including names, addresses, email addresses, and purchase history.

Affected Products

WP Crowdfunding WordPress plugin versions prior to 2.2.1
WordPress sites running WooCommerce integrations with the vulnerable plugin
Any deployment permitting Subscriber-level user registration alongside the plugin

Discovery Timeline

2026-08-12 - CVE-2026-14858 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-14858

Vulnerability Analysis

The WP Crowdfunding plugin exposes an endpoint that returns WooCommerce order details based on an order identifier supplied by the client. The endpoint authenticates the caller but does not authorize the request against the order's owner. Any user session, including one belonging to a Subscriber, satisfies the authentication check.

Because order identifiers in WooCommerce are sequential integers, an attacker can iterate through the identifier space and retrieve every order record on the site. Returned data typically includes billing and shipping addresses, email addresses, phone numbers, purchased items, and totals. The result is bulk personal data exposure without any code execution or write access to the store.

Root Cause

The root cause is a missing authorization check between the authenticated session and the resource requested. The plugin trusts a user-controlled key, the order identifier, to determine access. Ownership validation, capability checks against WooCommerce's view_order capability, or nonce binding to the current user are all absent from the vulnerable code path.

Attack Vector

An attacker registers or logs into any account on the target site. Sites that allow open user registration for commenting, membership, or crowdfunding participation satisfy this precondition. The attacker then issues requests to the vulnerable plugin endpoint, incrementing the order identifier parameter to enumerate the entire order table.

The vulnerability manifests in the plugin's order retrieval handler. See the WPScan Vulnerability Report for technical details on the vulnerable endpoint and request format.

Detection Methods for CVE-2026-14858

Indicators of Compromise

Repeated authenticated HTTP requests to WP Crowdfunding order endpoints from a single low-privileged user session
Sequential incrementing of the order_id or equivalent identifier parameter in access logs
Anomalous spikes in response payload size from plugin AJAX endpoints returning order data
Subscriber accounts issuing hundreds of requests within short time windows

Detection Strategies

Parse WordPress access logs for enumeration patterns against WP Crowdfunding endpoints, particularly requests with monotonically increasing numeric parameters
Correlate authenticated session identifiers against the volume of order records returned in the response body
Deploy a Web Application Firewall (WAF) rule to flag high-frequency requests to the plugin's order handler from non-administrative roles

Monitoring Recommendations

Enable WooCommerce order access auditing to record which user retrieved each order
Monitor creation of new Subscriber accounts followed by immediate access to plugin AJAX endpoints
Alert on any single account retrieving more than a defined threshold of distinct order records per hour

How to Mitigate CVE-2026-14858

Immediate Actions Required

Upgrade the WP Crowdfunding plugin to version 2.2.1 or later on all WordPress installations
Audit existing Subscriber and low-privileged accounts for suspicious order enumeration activity
Review WooCommerce order access logs from before the patch date for evidence of prior enumeration
Notify affected customers if evidence of personal data exposure is confirmed under applicable breach disclosure laws

Patch Information

The vendor addressed CVE-2026-14858 in WP Crowdfunding version 2.2.1 by adding ownership verification to the order retrieval endpoint. Refer to the WPScan Vulnerability Report for the fixed version and remediation guidance.

Workarounds

Disable the WP Crowdfunding plugin until the patched version is installed if immediate upgrade is not feasible
Restrict user registration on the site to trusted users only, reducing the pool of accounts that can trigger the vulnerability
Deploy a WAF rule that blocks unauthenticated and Subscriber-role requests to the vulnerable plugin endpoints

bash

# Example WP-CLI commands to check plugin version and update
wp plugin get wp-crowdfunding --field=version
wp plugin update wp-crowdfunding --version=2.2.1
wp plugin list --status=active | grep wp-crowdfunding