What is the CVSS score of CVE-2026-118083?

CVE-2026-118083 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-118083?

Within 24 hours, identify all WordPress sites using the WP Crowdfunding plugin by scanning your environment or using your CMS inventory, and either disable or remove the plugin from any site that does not absolutely require it; for sites where the plugin is essential, apply virtual patching via a web application firewall (WAF) rule to block unauthenticated access to plugin endpoints, and restrict access to wp-content/plugins/wp-crowdfunding/ through server configuration. Within 7 days, if a vendor patch becomes available (monitor Themeum's advisory), test and deploy it to all affected sites; otherwise, implement temporary code-level mitigations such as adding authentication checks to vulnerable endpoints or limiting plugin functionality, and conduct a review of web server logs for suspicious requests targeting the plugin. Within 30 days, complete migration to an alternative crowdfunding solution or apply the official patch once released, and update your vulnerability management process to include regular CMS plugin audits; ensure all WordPress installations and plugins are kept current to reduce future exposure.

WP Crowdfunding CVE-2026-118083

Q: Which versions of WP Crowdfunding are affected by CVE-2026-118083?

CVE-2026-118083 is a high-severity flaw in the Themeum WP Crowdfunding plugin (versions ≤2.2.2) that lets unauthenticated remote attackers read confidential data from WordPress sites.

EUVD-2026-113000 HIGH

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-10-29 Patchstack

GHSA-x73x-fm78-rgfm

WordPress Information Disclosure Wp Crowdfunding Wordpress Plugin Themeum

7.5

CVSS 3.1 · Vendor: Patchstack

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify WordPress site running WP Crowdfunding ≤ 2.2.2
Exploit

Send unauthenticated request to vulnerable endpoint
Execution

Retrieve exposed sensitive data
Impact

Exfiltrate disclosed information

Vulnerability Assessment

Weakness	CWE CWE-201 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V14 - Data Protection Outbound data filtering
Exploitation Conditions	Requires the WP Crowdfunding plugin by Themeum to be installed and active at version 2.2.2 or earlier on a WordPress site. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation is remote and unauthenticated against a default installation with no user interaction and low complexity. The specific endpoint, parameter, or feature that leaks the data is not described in the available sources, so no narrower configuration prerequisite can be confirmed; the main limiting factor is simply presence of a vulnerable plugin version. Impact is confidentiality-only (I:N/A:N) - the flaw discloses data but does not modify or disrupt the system.
Impact	Signals are mixed and point to a moderate, non-urgent priority. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N, base 7.5) describes a remotely reachable, unauthenticated information-disclosure flaw with no integrity or availability impact. The vuln.today decision label is 'this_week' (not act_now/emergency), which is consistent with a serious-but-not-critical issue. No EPSS score, no CISA KEV listing, and no confirmed working exploit were provided - the only reference is a Patchstack database entry, so active exploitation is not indicated. The CVSS vector and the description agree (both imply unauthenticated network access to disclose sensitive data), so there is no network-vs-local conflict here. The principal uncertainty is impact magnitude: C:H asserts high confidentiality loss, but the description (CWE-201, 'Sensitive Data Exposure') does not specify what data is exposed, so the severity of the disclosure cannot be independently confirmed from the available sources. Overall this is a legitimate patch-this-week issue rather than a drop-everything emergency, driven by the easy unauthenticated reachability rather than by any evidence of exploitation.
Exploit ScenarioDerived	A remote attacker who has not authenticated sends a request to a WordPress site running WP Crowdfunding 2.2.2 or earlier and retrieves sensitive data that the plugin exposes without authorization. The low attack complexity and lack of required privileges or user interaction mean the request can be issued directly against a default installation. No confirmed working exploit code was provided; only a Patchstack advisory reference exists.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 29, 2026

Unauthenticated sensitive data exposure in the Themeum WP Crowdfunding plugin affects versions up to and including 2.2.2, allowing remote attackers to read confidential information from WordPress sites where the plugin is active. The CVSS 3.1 score is 7.5 with confidentiality-only impact (C:H/I:N/A:N), and the vector requires no authentication or user interaction. No CISA KEV entry and no public exploit code are identified in the available data; no public exploit identified at time of analysis, and priority is assessed as this_week.

RemediationAI

No vendor-released patch identified at time of analysis; no fixed plugin version is listed in the available advisory data. The primary action is to deactivate and remove WP Crowdfunding until Themeum publishes a patched release, and to monitor the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wp-crowdfunding/vulnerability/wordpress-wp-crowdfunding-plugin-2-2-2-sensitive-data-exposure-vulnerability?_s_id=cve) for the fixed version. If the plugin cannot be removed, consider an edge WAF or virtual patching rule for the plugin's endpoints if a vetted rule is available, accepting the trade-offs of possible false positives, maintenance overhead, and incomplete coverage because the vulnerable endpoint is not identified in the available sources. Restricting or disabling public exposure of the crowdfunding pages is an alternative but removes the site's crowdfunding functionality.

Affected VersionsENISA

WP Crowdfunding n/a ≤2.2.2

Affected Packages

euvd wp_crowdfunding no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

WP Crowdfunding is a WordPress plugin from Themeum used to run crowdfunding campaigns. The flaw maps to CWE-201 (Insertion of Sensitive Information Into Sent Data), meaning sensitive information is included in data sent to a client; the exact endpoint, parameter, or feature that leaks the data is not described in the available sources. The CPE cpe:2.3:a:themeum:wp_crowdfunding:*:*:*:*:*:*:*:* identifies the plugin as the affected component, and the description bounds vulnerable versions at 2.2.2 and earlier. The assessed vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, so the issue is remotely reachable, low-complexity, unauthenticated, and confidentiality-only, with no integrity or availability impact.

Know when Wp Crowdfunding gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Patchstack) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI 7.5 HIGH

Unauthenticated remote data disclosure with no user interaction yields AV:N/AC:L/PR:N/UI:N and C:H; no integrity or availability impact, so I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

DescriptionCVE.org

Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions.

Executive ViewAI

Why It Matters

CVE-2026-118083 is a high-severity flaw in the Themeum WP Crowdfunding plugin (versions ≤2.2.2) that lets unauthenticated remote attackers read confidential data from WordPress sites. Any organization running this plugin on public-facing sites is exposed to potential data leakage, which could include donor or campaign information, undermining customer trust and regulatory compliance. Leadership should prioritize immediate mitigation because exploitation requires no credentials and no patch is currently available.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: disable or remove the plugin where non-essential; deploy WAF rules to block unauthenticated access to plugin endpoints; restrict direct access to plugin files via server configuration; monitor logs for anomalous requests; and consider implementing authentication or IP whitelisting for sensitive plugin functionality.

Threat Intelligence Overview

EPSS Score

0.3%

Top 77% exploitable

Prevalence

Low

niche WordPress crowdfunding plugin, limited install base

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.