CVE-2026-14857: unknown wp crowdfunding
Vulnerability summary
CVE-2026-14857 is a medium (CVSS 4.3) vulnerability in unknown wp crowdfunding. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 15.9% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 2.2.1.
Timeline
- 12-08-2026PublishedVulnerability first disclosed.
- 13-08-2026Last modifiedVulnerability information updated.
Description
The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- wordfenceSource4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.25%
Chance of exploitation in the next 30 days
Percentile
16%
Versus all other CVEs
30-day change
+0.07 pp
From 0.18% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
- CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Affected systems
Unknown1 product
- wp crowdfunding< 2.2.1
Wordpress1 product
- wp-crowdfunding< 2.2.1
2 vendors · 2 products