CVE-2026-14857

Executive Summary

CVE-2026-14857 is an authentication/authorization flaw in the WP Crowdfunding WordPress plugin by Themeum. Versions prior to 2.2.1 fail to verify that the authenticated user actually owns a campaign before allowing modification of that campaign’s update history and the sending of notification emails to campaign backers. This allows any authenticated user, including low-privilege WordPress Subscribers, to tamper with other users’ campaigns. The vulnerability is remotely exploitable over the network, requires only low-privilege authentication, and results in an integrity impact to affected campaigns.

Technical Analysis

The NVD description for CVE-2026-14857 is intentionally concise and does not expose specific function names, AJAX actions, or endpoint paths. The vulnerability is best classified as an Insecure Direct Object Reference (IDOR) flaw, aligned to CWE-639: Authorization Bypass Through User-Controlled Key.

The affected plugin exposes functionality that allows an authenticated user to modify a campaign’s update history and trigger notification emails to backers of that campaign. In affected versions, the application accepts a campaign identifier or similar resource reference supplied by the requesting user and performs the update/notification action without confirming that the currently authenticated account is the campaign owner. The check that should bind the campaign resource to the authenticated user is either missing or improperly implemented.

The attack surface is the front-end WordPress plugin functionality accessible to logged-in users. WordPress “Subscribers” have minimal default capabilities, but because the vulnerable operation relies on the presence of an authenticated session rather than a capability or ownership check, a Subscriber account is sufficient to exercise the flaw. The exact request format is not documented in the available data; it likely involves an HTTP POST to WordPress’s administrative or AJAX handling layer, but specific file paths, action names, and parameter keys are not disclosed.

The CVSS vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. It is network-exploitable, requires no user interaction, and needs only low-privilege authentication. The confidentiality impact is none, the integrity impact is low, and the availability impact is none. The EPSS score is 0.00185, indicating a low predicted probability of exploitation in the near term, and CISA KEV currently lists no known exploitation. However, the underlying flaw type is trivially understandable and may be discovered by WordPress plugin vulnerability scanners.

Exploitation Scenarios

No public proof-of-concept or exploit code was available at the time of analysis. The following attack chain is inferred from the vulnerability class described in the NVD entry.

1. Reconnaissance / target identification: The attacker obtains or already possesses a low-privilege account on the WordPress site, such as a standard Subscriber. The attacker identifies that the WP Crowdfunding plugin is installed and determines which campaign identifiers exist on the platform. Campaign identifiers can often be enumerated from public campaign listing pages or by observing the URLs of active fundraising campaigns.

2. Triggering the ownership-bypass flaw: The attacker sends a crafted authenticated request to the vulnerable plugin functionality, referencing a campaign identifier that belongs to another user. Because the plugin fails to verify ownership, the request is accepted as if the attacker had legitimate administrative rights over that specific campaign.

3. Payload / execution method: At the vulnerability-class level, the attacker supplies the target campaign’s identifier in place of their own, along with content intended for the campaign’s update history. Notification-related fields can also be manipulated to cause the plugin to send a notification email to the campaign’s backers. No privilege escalation or administrative account compromise is required.

4. Post-exploitation impact: The attacker successfully modifies the public update history of a victim campaign. The modified content may contain false information about campaign progress, fraudulent fundraising messages, or phishing links sent directly to backers. Because the victim campaign remains under the original owner’s control, the owner may not notice the modification immediately. The integrity of the crowdfunding platform is degraded, and backers may be misled.

It is important to note that this is not an unauthenticated remote code execution or data breach vulnerability. Its practical impact is limited to data-integrity manipulation of campaign information and the abuse of the notification mechanism for phishing or spam. Nonetheless, the fact that the lowest WordPress role can target arbitrary campaigns makes the vulnerability dangerous in multi-user WordPress deployments.

Impact Assessment

The primary business impact is reputational and trust-related. Crowdfunding platforms rely on campaign owners and backers trusting that the platform cannot be tampered with by unrelated users. An attacker with a Subscriber account can alter a public campaign’s update history, potentially causing financial confusion, false announcements, or backer distrust. The notification email feature may be abused to send phishing emails to all backers of a campaign, extending the impact beyond the WordPress application itself.

The CVSS subscores are: confidentiality none, integrity low, availability none. The “integrity low” rating reflects the limited but real ability to modify campaign content without direct access to the underlying filesystem or database. The attack requires no user interaction but does require network access and authentication, which justifies the low overall score of 4.3.

The blast radius is bounded to WordPress sites running the WP Crowdfunding plugin before version 2.2.1. Public-facing WordPress installations that permit self-registration or have already compromised low-privilege accounts are at greater risk. Because no patch has been confirmed by available tracking sources, any currently deployed affected version remains exposed.

Detection Guidance

The following detection rules are provided as templates. The NVD description does not disclose the exact plugin AJAX action names, function names, or request parameters. These rules focus on the plugin slug “wp-crowdfunding”, the generic concept of a “campaign” resource, and authenticated POST requests. Analysts should tune the rules with actual campaign-related endpoint names and parameters once observed in their environment.

Sigma Rule

title: Suspicious Authenticated Request to WP Crowdfunding Campaign Update Function
id: c0f1e2a3-7d9e-4b4a-9fcf-3e3c5b6a2d11
status: experimental
description: Detects POST requests to the WP Crowdfunding plugin that reference a campaign resource. Prior to version 2.2.1, the plugin does not verify campaign ownership and allows authenticated users to modify other campaigns and send notification emails to backers. Exact AJAX action names are not publicly documented; tune this rule with the observed plugin action names.
logsource:
  category: web
  product: generic
detection:
  selection:
    http.method: POST
    http.url|contains:
      - wp-crowdfunding
      - campaign
      - backers
  condition: selection
fields:
  - client.address
  - user.name
  - http.url
  - http.user_agent
falsepositives:
  - Campaign owners legitimately editing their own campaign update history
  - Administrators performing plugin-level maintenance
  - Site owners sending legitimate backer notifications
level: medium

YARA Rule

rule CVE_2026_14857_WP_Crowdfunding_IDOR
{
    meta:
        author = "ValtersIT SOC"
        description = "Detects artifacts, request dumps, or logs referencing indicators associated with WP Crowdfunding campaign ownership bypass vulnerability CVE-2026-14857."
        reference = "CVE-2026-14857"
        cwe = "CWE-639"
        date = "2026-01-01"
    strings:
        $s1 = "wp-crowdfunding" ascii nocase
        $s2 = "campaign" ascii nocase
        $s3 = "backers" ascii nocase
        $s4 = "update_history" ascii nocase
    condition:
        filesize < 1MB and all of them
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2026-14857 WP Crowdfunding Campaign Ownership Bypass Attempt";
    flow:established,to_server;
    content:"POST"; http_method;
    content:"wp-crowdfunding"; http_uri;
    content:"campaign"; http_client_body;
    classtype:attempted-admin;
    sid:202614857;
    rev:1;
    metadata: affected_product WordPress_WP_Crowdfunding, cve CVE-2026-14857;
)

Elastic Detection

http where http.request.method == "POST"
    and (
        url.path contains "wp-crowdfunding"
        or user_agent contains "wp-crowdfunding"
        or http.request.body.content contains "campaign"
        or http.request.body.content contains "backers"
    )
    and not user.name in ("admin") /* tune with known administrators */

Splunk SPL Query

index=web* sourcetype=access_combined
| where method=="POST"
| where like(uri,"%wp-crowdfunding%") OR like(uri,"%campaign%") OR like(uri,"%backers%")
| stats count by clientip, uri, user, status, action
| sort - count
| where count > 1

Wazuh OSSEC Rule

<group name="wordpress,crowdfunding,idor,">
  <rule id="100257" level="10">
    <decoded>
      <match>wp-crowdfunding</match>
      <match>campaign</match>
    </decoded>
    <description>Possible WP Crowdfunding CVE-2026-14857 campaign ownership bypass attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>authentication_failures,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4: no patch evidence from any tracked source is currently available. The NVD description states that the vulnerability exists “before 2.2.1,” which implies that version 2.2.1 contains a fix. However, no vendor advisory or patch source was provided, and this has not been independently confirmed. Treat the plugin as unpatched until a vendor advisory explicitly confirms the fix.

1. Immediate mitigations:

   • If the site does not require the WP Crowdfunding plugin, disable and remove it until a confirmed patch is available.
   • If the plugin must remain active, restrict registration to trusted users. Do not allow open self-registration that creates Subscriber accounts.
   • If available, apply any released update to version 2.2.1, but verify the change from an official vendor source before relying on it as a complete fix.
   • Audit existing campaign update history entries and notification logs for unexplained modifications. Restore any tampered campaign content.

2. Patch/upgrade steps:

   • Verify the currently installed WP Crowdfunding version. If it is earlier than 2.2.1, upgrade through the WordPress plugin repository or the vendor’s distribution channel.
   • Confirm the vendor’s official changelog and advisory for CVE-2026-14857 before deploying.
   • Test the update in a staging environment, ensuring that campaign ownership checks are enforced for update-history modifications and backer notification emails.

3. Long-term hardening:

   • Monitor WordPress user role assignments; remove unnecessary Subscriber accounts and disable unused registration endpoints.
   • Use a WordPress Web Application Firewall or IDS to detect POST requests to plugin campaign functions from low-privileged accounts.
   • Integrate WordPress security audit logging into the SIEM to track all campaign modification events.
   • Periodically review plugins for known CVEs in the NVD and CISA KEV catalogs.

References

1. NVD entry for CVE-2026-14857 — https://nvd.nist.gov/vuln/detail/CVE-2026-14857
2. CWE-639: Authorization Bypass Through User-Controlled Key — https://cwe.mitre.org/data/definitions/639.html
3. WordPress Plugin Directory: WP Crowdfunding — https://wordpress.org/plugins/wp-crowdfunding/
4. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (no current entry for CVE-2026-14857)

No known threat actor campaigns or exploit-in-the-wild evidence were available at the time of writing. Public proof-of-concept or exploit code status remains unknown and warrants continued monitoring.