CVE-2026-14859
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions. Any authenticated users such as Subscribers can create crowdfunding campaign posts despite not being granted that permission.
Risk Assessment
Risk of unauthorized campaign creation, potentially leading to abuse, spam, and resource strain. Low-privileged users can publish content without consent.
Recommendation
Update the WP Crowdfunding plugin to version 2.2.1 or later. Verify that AJAX actions require proper capabilities.
Original NVD description (English source)
The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts despite not being granted that permission.