WP Crowdfunding CVE-2026-14858

Exploitation requires the attacker to hold at least a WordPress Subscriber-level account - on sites with open user registration (a common default), any external actor can self-register to obtain this. The WP Crowdfunding plugin must be installed and active, and the store must use WooCommerce for order management; no non-default feature flag or special configuration beyond the plugin's presence is required. What limits exploitation: the PR:L requirement means a valid WordPress account is mandatory, so sites that disable open registration reduce external attacker surface; however, any existing low-privilege authenticated user (e.g., campaign backers, newsletter subscribers with WordPress accounts) retains full exploitation capability. Impact is strictly read-only - order PII exposure and enumeration - with no write, delete, or privilege-escalation capability from this flaw alone.

The CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) correctly reflects network accessibility with low-complexity exploitation requiring only a basic authenticated account, and limits impact to confidentiality. However, the 14% EPSS probability is notably elevated for a plugin-level medium-severity flaw, indicating that exploitation tooling and attacker interest are already present in the ecosystem - even a mid-sized municipal IT team in rybnik operating a WooCommerce storefront should treat this as a near-term patching priority rather than a back-burner issue. The publicly available WPScan exploit proof-of-concept materially lowers the skill threshold: order enumeration is trivially automatable with sequential ID probing. The PR:L prerequisite is weak on sites with open user registration, where any external actor can self-register. No CISA KEV listing exists at time of analysis, distinguishing this from confirmed mass-exploitation campaigns, but POC availability combined with a high-EPSS profile and easy prerequisite satisfaction makes this a credible data-exposure risk for active stores.

An attacker registers a free Subscriber account on a WordPress store running the vulnerable WP Crowdfunding plugin, then uses the publicly available WPScan-documented exploit to iterate sequential WooCommerce order IDs via the plugin's order-detail endpoint. Each successful request returns the full order record - including customer name, billing address, shipping address, and email - without any ownership check, enabling bulk exfiltration of the store's customer PII in a single automated session.