WP Crowdfunding CVE-2026-73189

Exploitation requires the attacker to hold a subscriber-level (or higher) authenticated account on the target WordPress installation, confirmed by the CVSS vector PR:L. The WP Crowdfunding plugin (Themeum) must be installed and active on the site in a version prior to 2.2.1. Network access to the WordPress site is required (AV:N). Exploitation is limited to confidentiality - attackers can read restricted object data but cannot modify or delete records (I:N, A:N). Sites that do not permit open user self-registration significantly limit the attacker pool, as account creation becomes a prerequisite that requires either social engineering or a separate account-creation vulnerability. No specific non-default plugin configuration is documented as required beyond the plugin being active.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N yields a score of 6.5 (Medium), which accurately reflects the risk profile: network-exploitable with low attack complexity but requiring at least a subscriber account (PR:L). The confidentiality impact is rated High, suggesting full or significant exposure of protected campaign or backer data - no integrity or availability impact is present, consistent with a read-only IDOR. No EPSS data was provided, KEV status is absent (meaning no confirmed active exploitation), and no POC code has been identified. Despite the Medium base score, the practical risk on sites with open user registration is elevated - subscriber accounts on WordPress are trivially obtainable on most sites that allow self-registration, effectively reducing the authentication barrier. The tag 'Authentication Bypass' is noted but may reflect the bypassing of object-level authorization rather than bypassing login authentication entirely; this distinction should be verified with the Patchstack advisory.

An attacker registers a free subscriber account on a WordPress site running WP Crowdfunding prior to 2.2.1, then submits authenticated API or form requests with sequentially enumerated or guessed object IDs referencing campaigns or backer records owned by other users. By iterating over valid object identifiers, the attacker retrieves confidential campaign details, donor identities, or financial contribution records that the plugin fails to restrict at the authorization layer. No public exploit code has been identified, but the low technical complexity of IDOR exploitation means this is within reach of any moderately skilled attacker with a valid account.