CVE-2026-73189

MediumCVSS 6.5

Published: 18/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

26th percentile - higher than 26% of all known CVEs

Summary

Insecure Direct Object References (IDOR) vulnerability in WP Crowdfunding versions earlier than 2.2.1. The attack requires subscriber-level privileges.

Risk Assessment

A subscriber can access objects (e.g., other users' data) without authorization, potentially leading to data leakage or manipulation.

Recommendation

Update the WP Crowdfunding plugin to version 2.2.1 or later, which includes the fix.

Original NVD description (English source)

Subscriber Insecure Direct Object References (IDOR) in WP Crowdfunding < 2.2.1 versions.