SQL Injection Vulnerability in WP Crowdfunding Plugin for WordPress

CVE-2026-19944

What is CVE-2026-19944?

The WP Crowdfunding plugin for WordPress has a SQL Injection vulnerability that allows authenticated users, specifically those with shop manager-level access or higher, to exploit insufficient validation and escaping on user-supplied parameters. This vulnerability enables attackers to append malicious SQL queries into existing queries through the ‘wpneo_reward’ Post Meta, potentially accessing sensitive information stored in the database. Notably, this is a second-order injection where a Shop Manager can inject a payload via the WooCommerce REST products endpoint, executing it on subsequent public page views that display the rewards sidebar.

References