EUVD-2026-60939
GHSA-4928-5chh-qpxf
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Subscriber account required (PR:L); network-reachable IDOR exposes confidential data (C:H) with no write or availability impact; low complexity and no interaction needed.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
Subscriber Insecure Direct Object References (IDOR) in WP Crowdfunding < 2.2.1 versions.
AnalysisAI
Insecure Direct Object References in WP Crowdfunding (Themeum) versions prior to 2.2.1 allow authenticated subscriber-level users to access campaign objects, donor records, or financial data they are not authorized to view. The vulnerability, discovered and reported by Patchstack, stems from missing authorization checks on direct object references within the plugin, enabling lateral data exposure across campaigns or users. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold a subscriber-level (or higher) authenticated account on the target WordPress installation, confirmed by the CVSS vector PR:L. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N yields a score of 6.5 (Medium), which accurately reflects the risk profile: network-exploitable with low attack complexity but requiring at least a subscriber account (PR:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a free subscriber account on a WordPress site running WP Crowdfunding prior to 2.2.1, then submits authenticated API or form requests with sequentially enumerated or guessed object IDs referencing campaigns or backer records owned by other users. By iterating over valid object identifiers, the attacker retrieves confidential campaign details, donor identities, or financial contribution records that the plugin fails to restrict at the authorization layer. … |
| Remediation | Upgrade WP Crowdfunding to version 2.2.1 or later immediately, as a vendor-released patch is available per Patchstack's advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Crowdfunding
View allWP Crowdfunding WordPress plugin before version 2.2.1 allows any subscriber-level authenticated user to create crowdfund
Insecure Direct Object Reference in WP Crowdfunding (WordPress plugin, all versions before 2.2.1) allows any authenticat
Broken object-level authorization in the WP Crowdfunding WordPress plugin before 2.2.1 allows any authenticated user - i
The WP Crowdfunding WordPress plugin before 2.1.9 does not sanitise and escape a parameter before outputting it back in
The WP Crowdfunding WordPress plugin before 2.1.8 does not sanitise and escape some of its settings, which could allow h
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum WP Crowdfu
The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wp-crowdfunding/search blo
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcf_donate short
The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability c
Missing Authorization vulnerability in Themeum WP Crowdfunding allows Exploiting Incorrectly Configured Access Control S
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today