Executive brief
WP Crowdfunding is a WordPress plugin for crowdfunding campaigns integrated with WooCommerce order management. The plugin fails to verify that a user owns an order before returning its details, allowing any authenticated user (even with minimal Subscriber permissions) to view sensitive customer data including billing addresses, phone numbers, emails, and order contents from any order in the store. An attacker can systematically enumerate all orders in the system to harvest customer information.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) in the WP Crowdfunding plugin's order retrieval endpoint (wpcf_order_action AJAX action). The vulnerable component fails to enforce access controls when returning order details via the admin-ajax.php endpoint. Attack preconditions are minimal: an attacker needs only an authenticated account with the Subscriber role and access to the cf_ajax_nonce value (which is exposed in page source for all logged-in users). By sending a POST request to admin-ajax.php with sequential order IDs, an attacker can enumerate and read every WooCommerce order's complete details including personal billing information. The vulnerability is fixed in version 2.2.1.
Affected products
- Automattic WP Crowdfunding before 2.2.1
Timeline
- 2026-08-10: disclosed
- 2026-08-12: patched: Fixed in version 2.2.1