CVE-2026-73189: WP Crowdfunding IDOR Vulnerability

CVE-2026-73189 Overview

CVE-2026-73189 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] affecting the WP Crowdfunding WordPress plugin in versions prior to 2.2.1. The flaw allows authenticated users with subscriber-level privileges to access resources belonging to other users by manipulating object identifiers in requests. Exploitation requires low privileges and no user interaction, and the attack is performed over the network. The vulnerability affects confidentiality but does not impact integrity or availability of the underlying system.

Critical Impact
Authenticated subscribers can read sensitive data belonging to other WP Crowdfunding users by tampering with object references, exposing campaign details, backer information, and related private records.

Affected Products

WP Crowdfunding WordPress plugin versions prior to 2.2.1
WordPress sites running vulnerable WP Crowdfunding installations
Any WP Crowdfunding deployment accepting authenticated subscriber accounts

Discovery Timeline

2026-08-18 - CVE-2026-73189 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-73189

Vulnerability Analysis

The vulnerability stems from missing authorization checks on user-supplied object identifiers within WP Crowdfunding plugin endpoints. The plugin trusts identifiers submitted by authenticated users without verifying that the requester owns the referenced resource. A subscriber-level account can therefore substitute another user's object ID and retrieve data outside their authorization scope.

WP Crowdfunding manages crowdfunding campaigns, pledges, and backer records. Unauthorized read access to these objects exposes campaign metadata, contributor identities, and related transactional information. The CWE-639 classification confirms the root cause as authorization based on user-controlled keys.

Root Cause

The plugin implements object retrieval using direct references passed in HTTP parameters without correlating the reference to the authenticated user's ownership. Access control decisions rely on whether a session is authenticated rather than whether the session has rights to the target object. This design gap allows horizontal privilege escalation between accounts of the same role.

Attack Vector

An attacker registers or uses an existing subscriber account on the target WordPress site. The attacker then issues requests to plugin endpoints while iterating or guessing object identifiers such as campaign IDs, pledge IDs, or user IDs. The server returns records associated with the supplied identifier regardless of ownership, disclosing confidential data.

The vulnerability manifests in plugin request handlers that accept object identifiers without ownership validation. See the Patchstack WordPress Vulnerability Report for technical details.

Detection Methods for CVE-2026-73189

Indicators of Compromise

Repeated authenticated requests from a single subscriber account to WP Crowdfunding endpoints with sequentially changing numeric identifiers
Access log entries showing subscriber accounts retrieving campaign or pledge records they did not create
Unusual response sizes returned to low-privilege accounts on crowdfunding-related endpoints

Detection Strategies

Correlate WordPress user session identifiers against the ownership of resources returned in plugin responses
Alert on subscriber-role accounts issuing high volumes of requests with varying object ID parameters
Baseline normal subscriber activity on WP Crowdfunding endpoints and flag deviations in ID enumeration patterns

Monitoring Recommendations

Enable WordPress and web server access logging with query parameters preserved for later analysis
Monitor plugin AJAX and REST endpoints such as admin-ajax.php actions associated with wp-crowdfunding
Track HTTP 200 responses to subscriber accounts on endpoints that should require higher privileges

How to Mitigate CVE-2026-73189

Immediate Actions Required

Update the WP Crowdfunding plugin to version 2.2.1 or later on all affected WordPress sites
Audit existing subscriber accounts and remove inactive or suspicious registrations
Review web server logs for evidence of ID enumeration against WP Crowdfunding endpoints prior to patching

Patch Information

The vendor addressed the IDOR vulnerability in WP Crowdfunding version 2.2.1. Site administrators should upgrade the plugin through the WordPress dashboard or by replacing the plugin files with the fixed release. Refer to the Patchstack WordPress Vulnerability Report for advisory details.

Workarounds

Disable new user registration on WordPress sites running vulnerable WP Crowdfunding versions until patching is complete
Restrict access to WP Crowdfunding endpoints using a Web Application Firewall (WAF) rule that inspects object ID parameters
Temporarily deactivate the WP Crowdfunding plugin if a patch cannot be applied immediately

bash

# Update WP Crowdfunding via WP-CLI
wp plugin update wp-crowdfunding --version=2.2.1
wp plugin list --name=wp-crowdfunding --fields=name,status,version