WP Crowdfunding EUVD-2026-57078

Exploitation requires a valid WordPress account at Subscriber role or higher on the target site - the lowest authenticated role available. The target site must be running the WP Crowdfunding plugin at a version prior to 2.2.1. The attacker must be able to identify or enumerate a target campaign ID, which is typically possible through the site's public campaign listing pages. No special server-side configuration, non-default plugin settings, or elevated privileges beyond a basic registered account are required. Exploitation is limited by the need for an authenticated session (PR:L per CVSS vector), meaning sites that do not allow open user registration are substantially less exposed. The SSVC assessment additionally confirms non-automatability, suggesting mass exploitation across many sites simultaneously is not feasible without per-site account acquisition.

The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) reflects a network-reachable, low-complexity flaw requiring only authenticated access, with limited integrity impact and no confidentiality or availability consequences. Despite the moderate raw score, several amplifying signals raise practical priority: a public proof-of-concept exists (confirmed via WPScan), and the EPSS score of 14% is significantly above baseline for WordPress plugin CVEs, suggesting meaningful real-world exploitation interest. SSVC assessment rates this as poc-level exploitation, non-automatable at scale, and partial technical impact - consistent with targeted campaign manipulation rather than mass exploitation. The vulnerability is NOT listed in CISA KEV, indicating no confirmed widespread active exploitation at time of analysis. The practical risk is highest for sites where multiple user roles are open for registration, where campaign integrity and backer trust are business-critical, and where reputation damage from fraudulent backer notifications could be severe - risks that the low CVSS score does not fully capture.

An attacker registers a free subscriber account on a WordPress site running the vulnerable WP Crowdfunding plugin, then enumerates campaign IDs - which are typically sequential integers or slugs discoverable through the site's public campaign listings. The attacker submits a crafted campaign update request referencing a victim campaign owner's ID, injecting false or misleading update history content, which then triggers the plugin to dispatch notification emails to all of that campaign's backers - potentially spreading disinformation, damaging the campaign owner's reputation, or undermining donor trust. A public proof-of-concept is available, lowering the technical barrier for this scenario.