CVE-2026-14857
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers. Any authenticated users such as Subscribers can alter other users' campaigns.
Risk Assessment
Risk of tampering with other users' campaigns, potentially leading to misinformation of backers, fraud, and loss of trust in the platform.
Recommendation
Update the WP Crowdfunding plugin to version 2.2.1 or later. Add campaign ownership checks before modifying history and sending notifications.
Original NVD description (English source)
The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns.