WP Crowdfunding CVE-2026-14859

Exploitation requires a valid WordPress account with at minimum Subscriber-level privileges - the lowest authenticated role. The attacker must be able to reach the wp-admin/admin-ajax.php endpoint over the network. Sites with open user registration are at highest risk because an attacker can self-register a Subscriber account without administrator involvement. The vulnerability is specific to the AJAX campaign-submission action within the WP Crowdfunding plugin; the plugin must be installed and active. There is no requirement for any non-default plugin configuration - the flaw exists in the default code path. Exploitation is limited by the requirement for at least one valid credential, meaning fully unauthenticated exploitation is not possible.

The CVSS 3.1 base score of 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N correctly characterizes this as a low-complexity, network-accessible flaw requiring only a low-privilege account. The impact is limited to integrity (I:L) - unauthorized campaign post creation - with no confidentiality or availability consequence. The 14% EPSS score is elevated relative to typical medium-severity WordPress plugin findings, suggesting the public WPScan disclosure and available PoC have attracted attacker interest. The vulnerability is not listed in CISA KEV, so widespread active exploitation is not confirmed. The real-world risk is highest for WordPress sites with open user registration (which allows Subscriber accounts to be freely created by attackers); sites with registration disabled face substantially reduced exposure as exploitation still requires a valid credential.

An attacker registers a free Subscriber account on a target WordPress site (or reuses compromised credentials), then sends a crafted AJAX POST request directly to the wp-admin/admin-ajax.php endpoint targeting the vulnerable action, bypassing the campaign-submission permission check. Because the capability gate is missing, the server processes the request and creates a published crowdfunding campaign post under the attacker's account. A public exploit is documented by WPScan, lowering the technical barrier to exploitation significantly.