EUVD-2026-57078
GHSA-fmm2-vv76-h6wg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-reachable by any authenticated user (PR:L) with no special conditions; only integrity is impacted via unauthorized campaign history writes, with no confidentiality or availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns.
AnalysisAI
Broken object-level authorization in the WP Crowdfunding WordPress plugin before 2.2.1 allows any authenticated user - including low-privilege Subscribers - to modify the update history of campaigns they do not own and trigger notification emails to that campaign's backers. The vulnerability stems from missing ownership verification on campaign update endpoints, enabling horizontal privilege escalation across all campaigns on the affected site. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress account at Subscriber role or higher on the target site - the lowest authenticated role available. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) reflects a network-reachable, low-complexity flaw requiring only authenticated access, with limited integrity impact and no confidentiality or availability consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a free subscriber account on a WordPress site running the vulnerable WP Crowdfunding plugin, then enumerates campaign IDs - which are typically sequential integers or slugs discoverable through the site's public campaign listings. The attacker submits a crafted campaign update request referencing a victim campaign owner's ID, injecting false or misleading update history content, which then triggers the plugin to dispatch notification emails to all of that campaign's backers - potentially spreading disinformation, damaging the campaign owner's reputation, or undermining donor trust. … |
| Remediation | The primary fix is to update the WP Crowdfunding plugin to version 2.2.1 or later, which introduces the missing ownership verification check on campaign update endpoints. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Crowdfunding
View allWP Crowdfunding WordPress plugin before version 2.2.1 allows any subscriber-level authenticated user to create crowdfund
Insecure Direct Object Reference in WP Crowdfunding (WordPress plugin, all versions before 2.2.1) allows any authenticat
The WP Crowdfunding WordPress plugin before 2.1.9 does not sanitise and escape a parameter before outputting it back in
The WP Crowdfunding WordPress plugin before 2.1.8 does not sanitise and escape some of its settings, which could allow h
Insecure Direct Object References in WP Crowdfunding (Themeum) versions prior to 2.2.1 allow authenticated subscriber-le
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum WP Crowdfu
The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wp-crowdfunding/search blo
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcf_donate short
The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability c
Missing Authorization vulnerability in Themeum WP Crowdfunding allows Exploiting Incorrectly Configured Access Control S
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today