medium4.3
CVE-2026-14859
The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated user…
Impact
The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts despite not being granted that permission.
Affected products
| Product | Affected versions |
|---|---|
| WP Crowdfunding WordPress Plugin | before 2.2.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.