CVE-2026-19944: WP Crowdfunding SQL Injection Vulnerability

CVE-2026-19944 Overview

CVE-2026-19944 is a second-order SQL Injection vulnerability [CWE-89] affecting the WP Crowdfunding plugin for WordPress in all versions up to and including 2.2.1. The flaw resides in the handling of the wpneo_reward post meta value, which is concatenated into a database query without sufficient escaping or parameterized preparation. Authenticated users with Shop Manager privileges or higher can inject arbitrary SQL fragments that execute on subsequent public page views rendering the campaign rewards sidebar. Successful exploitation allows extraction of sensitive information from the WordPress database.

Critical Impact
A Shop Manager can persist a malicious payload via the WooCommerce REST products endpoint, and the injected query executes for every visitor viewing the associated crowdfunding campaign.

Affected Products

WP Crowdfunding plugin for WordPress, versions up to and including 2.2.1
WordPress installations that expose the WooCommerce REST API endpoint POST/PUT /wp-json/wc/v3/products/{id}
Sites where Shop Manager or higher roles are delegated to untrusted operators

Discovery Timeline

2026-09-09 - CVE-2026-19944 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-19944

Vulnerability Analysis

The vulnerability is a stored, second-order SQL injection in the WP Crowdfunding plugin. The plugin persists a wpneo_reward value as WordPress post meta, then later interpolates that value into an SQL query that renders the campaign rewards sidebar on public campaign pages. The injection point is not the request that stores the payload; the SQL executes when unauthenticated visitors view the affected product page, which makes the vulnerability persistent and remotely triggerable after the initial write.

The write vector is the standard WooCommerce REST products endpoint (POST/PUT /wp-json/wc/v3/products/{id}), which accepts arbitrary meta fields. A Shop Manager writes the payload once, and every subsequent public render of the rewards sidebar re-executes the tainted query. The impact is limited to confidentiality — attackers can exfiltrate rows from the database, including data from wp_users and wp_usermeta.

Root Cause

The plugin templates at wpcftemplate/woocommerce/basic/include/tabs/rewards-sidebar-form.php and helper functions in wpcftemplate/woocommerce/basic/wpneo-functions.php read the wpneo_reward post meta and place its contents directly into an SQL statement. WordPress's $wpdb layer is not used with prepare() and placeholders for the tainted segment, and no escaping is applied to the meta value before concatenation. Because the value is trusted at read time rather than at write time, the write path does not sanitize it either.

Attack Vector

An authenticated attacker with Shop Manager or higher role authenticates to the WooCommerce REST API and issues a POST or PUT request against a crowdfunding product, setting the wpneo_reward meta to a crafted payload containing SQL syntax such as a UNION SELECT clause. The payload is stored verbatim in wp_postmeta. When any visitor loads the associated public product page, the plugin renders the rewards sidebar, reads the meta, and executes the resulting SQL against the WordPress database. The attacker retrieves exfiltrated data by observing the rendered page contents or by chaining time-based techniques.

See the WordPress Plugin Code Reference for rewards-sidebar-form.php and the wpneo-functions.php helper for the vulnerable code paths.

Detection Methods for CVE-2026-19944

Indicators of Compromise

Rows in wp_postmeta where meta_key = 'wpneo_reward' and meta_value contains SQL tokens such as UNION, SELECT, SLEEP(, INFORMATION_SCHEMA, or unbalanced quotes.
Recent POST or PUT requests to /wp-json/wc/v3/products/{id} originating from Shop Manager accounts that modify the meta_data array.
Unusual database error messages or long response times when loading public crowdfunding campaign pages.

Detection Strategies

Query the WordPress database for wp_postmeta entries with meta_key = 'wpneo_reward' and inspect any values containing SQL keywords, comment markers (--, #, /*), or backticks.
Enable WooCommerce REST API logging and correlate write operations against the wpneo_reward meta with the authenticated user identity.
Deploy a Web Application Firewall (WAF) ruleset that inspects JSON bodies submitted to /wp-json/wc/v3/products/ for SQL injection signatures within meta_data entries.

Monitoring Recommendations

Alert on any Shop Manager or Administrator API token performing write operations against crowdfunding products outside expected business hours.
Monitor MySQL slow query and error logs for anomalies tied to page renders of crowdfunding product templates.
Track the Wordfence Vulnerability Report for updated signatures and exploitation telemetry.

How to Mitigate CVE-2026-19944

Immediate Actions Required

Update the WP Crowdfunding plugin to the version published in the WordPress Plugin Changeset 3677675, which addresses this issue.
Audit all wp_postmeta rows with meta_key = 'wpneo_reward' and remove or sanitize any values containing SQL syntax.
Review Shop Manager accounts and rotate credentials or API keys for any account that could have been abused.

Patch Information

The vendor addressed the vulnerability in the changeset referenced above by revising the affected template and helper code. Site operators running WP Crowdfunding 2.2.1 or earlier must upgrade to the patched release. Verify the installed version in the WordPress admin under Plugins after upgrade.

Workarounds

Restrict the Shop Manager role assignment to trusted administrators only and disable the role for third-party operators until patched.
Block or restrict access to /wp-json/wc/v3/products/ at the WAF or reverse proxy for all clients except known integration IP addresses.
Temporarily deactivate the WP Crowdfunding plugin if a patched version cannot be deployed and public campaign pages are exposed to untrusted visitors.

bash

# Example: audit stored wpneo_reward post meta for suspicious SQL tokens
wp db query "SELECT post_id, meta_value FROM wp_postmeta \
  WHERE meta_key = 'wpneo_reward' \
  AND (meta_value LIKE '%UNION%' \
    OR meta_value LIKE '%SELECT%' \
    OR meta_value LIKE '%SLEEP(%' \
    OR meta_value LIKE '%information_schema%');"