Unauthorized Campaign Creation in WP Crowdfunding Plugin
CVE-2026-14859
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 12 August 2026
Badges
What is CVE-2026-14859?
The WP Crowdfunding plugin for WordPress prior to version 2.2.1 features an authorization bypass flaw. This vulnerability allows authenticated users, including those with subscriber privileges, to submit crowdfunding campaign posts without the necessary permissions. Specifically, the plugin does not properly validate user capabilities in one of its AJAX actions, leading to unauthorized actions that can compromise the integrity of campaign management. It is crucial for users of this plugin to update to the latest version to mitigate the risk associated with this flaw.
Affected Version(s)
WP Crowdfunding 0 < 2.2.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.