CVE-2026-14859— WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Creation via Missing Authorization
Possible ATT&CK Techniques 1AI
T1136.001 · Local AccountAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | WP Crowdfunding | < 2.2.1 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-14859
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Creation via Missing Authorization
Source: CVE Program / CVE List V5
Vulnerability Description
The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts despite not being granted that permission.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress WP Crowdfunding 权限许可和访问控制问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress WP Crowdfunding是WordPress基金会开源的一款众筹插件。 WordPress WP Crowdfunding 2.2.1之前版本存在权限许可和访问控制问题漏洞，该漏洞源于未对AJAX操作中的campaign-submission能力进行检查，可能导致任何已认证用户（如订阅者）在未被授权的情况下创建众筹活动帖子。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | WP Crowdfunding | 0 ~ 2.2.1 | - |
II. Public POCs for CVE-2026-14859
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-14859
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-14859 (1)
- 🔗 WP Crowdfunding < 2.2.1 – Subscriber+ Campaign Creation via Missing Authorization | CVE 2026-14859 | Plugin Vulnerabilities Read full article exploitvdb-entrytechnical-description
Same Patch Batch · Unknown · 2026-08-12 · 44 CVEs total
| CVE-2026-16747 | 6.5 MEDIUM | Kirki < 6.2.1 - Unauthenticated Arbitrary Shortcode Execution via Form Email Actions |
| CVE-2026-15045 | 6.5 MEDIUM | Wallet System for WooCommerce < 2.7.10 - Customer+ Checkout Price Manipulation via Unvalid |
| CVE-2026-17008 | 5.3 MEDIUM | Quick PayPal Payments <= 5.7.50 - Unauthenticated Payment Bypass via PayPal IPN |
| CVE-2026-16990 | 5.3 MEDIUM | Payment Button for PayPal <= 1.2.3.44 - Unauthenticated Payment Price Manipulation |
| CVE-2026-15213 | 5.3 MEDIUM | Welcart e-Commerce < 2.11.33 - Unauthenticated Payment Bypass via Forged Settlement Callba |
| CVE-2026-16621 | 5.3 MEDIUM | Payment Gateway for PayPal on WooCommerce < 9.2.1 - Unauthenticated Payment Bypass via Pay |
| CVE-2026-18044 | 3.7 LOW | Estatik Real Estate Plugin < 4.3.4 - Unauthenticated Arbitrary-Recipient Mail Relay via Si |
| CVE-2026-13613 | KiviCare < 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint | |
| CVE-2026-17013 | WP Photo Album Plus < 9.2.07.002 - Reflected XSS via lbstart | |
| CVE-2026-13177 | Eventin < 4.1.20 - Contributor+ Order Information Disclosure via IDOR | |
| CVE-2026-12976 | LearnPress < 4.4.4 - Subscriber+ Sensitive Information Exposure via AI Assistant | |
| CVE-2026-13612 | KiviCare < 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDO | |
| CVE-2026-15039 | Gift Cards For WooCommerce Pro < 4.2.10 - Unauthenticated Arbitrary File Upload | |
| CVE-2026-15388 | Cookie Consent < 0.0.10 - Subscriber+ Consent Settings Update and Consent Log Disclosure | |
| CVE-2026-16538 | TeraWallet - Wallet for WooCommerce < 1.6.10 - Subscriber+ Wallet Balance Inflation via Di | |
| CVE-2026-16066 | Welcart e-Commerce < 2.11.34 - Author+ Stored XSS via Product Name | |
| CVE-2026-16253 | Total Upkeep (BoldGrid Backup) < 1.17.3 - Unauthenticated Sensitive Data Disclosure and Fo | |
| CVE-2026-16294 | Blubrry PowerPress < 11.17.1 - Contributor+ Server-Side Request Forgery via Podcast Episod | |
| CVE-2026-16051 | WPMU DEV Dashboard < 5.0.1 - Remote Code Execution via Hub Install Action | |
| CVE-2026-13171 | Eventin < 4.1.20 - Unauthenticated Account Creation via Waiting List Endpoint |
Showing top 20 of 44 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: WP Crowdfunding
- CVE-2026-14857
WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Update Modifi - CVE-2026-14858
WP Crowdfunding < 2.2.1 - Subscriber+ Order Data Disclosure - CVE-2025-31892
WordPress WP Crowdfunding plugin <= 2.1.15 - Cross Site Scri - CVE-2025-1508
WP Crowdfunding <= 2.1.14 - Missing Authorization to Authent - CVE-2023-41870
WordPress WP Crowdfunding plugin <= 2.1.5 - Broken Access Co
Same vendor: Unknown
- CVE-2026-18039
Essential Addons for Elementor < 6.7.2 - Unauthenticated Pri - CVE-2026-15205
Paymob for WooCommerce < 4.1.9 - Unauthenticated SQL Injecti - CVE-2026-16739
Epeken All Kurir <= 2.1.2 - Unauthenticated Order Payment Co - CVE-2026-14290
Embed Google Photos Album Easily <= 2.2.1 - Contributor+ Sto - CVE-2026-15413
Link Factory - Backdoor
V. Comments for CVE-2026-14859
No comments yet