CVE-2026-14858

MediumCVSS 4.3/10Last modified Aug 26, 2026

Description

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Aug 12, 2026
Last modified: Aug 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-148594.3The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any CVE-2026-14868.8A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Pro CVE-2026-148605.3The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input,CVE-2026-148617.5The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is author CVE-2026-148623.7The Support Genix WordPress plugin before 1.4.48 does not properly authorize access to support-ticket attachment downloads, allowing unauth CVE-2026-148638.8FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve r CVE-2026-148645.4The JetEngine WordPress plugin before 3.8.12 does not escape a post meta value before outputting it through one of its shortcodes, allowing CVE-2026-148655.3In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML without disabling DTD CVE-2026-148667.1IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to injection of rogue certificate authority due to publicly writeable t CVE-2026-148675.5Credentials of built-in users are insecurely stored in the User directory of PcVue projects, all versions prior to 17.0.0. A local attacker CVE-2026-148685.5The encryption algorithm used to protect the configuration of user accounts, stored in the built-in user directory of PcVue projects, all ve CVE-2026-148698.6The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may