# CVE-2026-14859: WP Crowdfunding authorization bypass in campaign submission

Source: https://junglewise.ai/threats/cve-2026-14859-wp-crowdfunding-authorization-bypass-in-campaign-submission  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-14859 · Severity: medium · CVSS 4.3 · Published 2026-08-12

WP Crowdfunding is a WordPress plugin that allows site owners to host crowdfunding campaigns. The plugin fails to properly check user permissions before allowing campaign creation through an AJAX endpoint, enabling any logged-in user (even low-privilege subscribers) to create campaigns they should not have access to. This breaks intended access controls and can lead to unauthorized content creation or spam.

Technologies: [WP Crowdfunding](https://junglewise.ai/threats/technologies/wp-crowdfunding). Vendors: [WP Crowdfunding](https://junglewise.ai/threats/vendors/wp-crowdfunding).

## Quick answers

**Is CVE-2026-14859 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14859 being exploited in the wild.

**How severe is CVE-2026-14859?** Medium severity, with a CVSS score of 4.3, published 12 August 2026.

**Which products and versions are affected?** WP Crowdfunding before 2.2.1.

**Is there a fix for CVE-2026-14859?** A patch was published on 2026-08-12: Fixed in version 2.2.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-14859 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-14859?** Check whether you run WP Crowdfunding at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass (broken access control) in the AJAX action "addfrontenddata" used for campaign submission. The plugin does not verify the campaign-submission capability before processing campaign creation requests, despite requiring this permission during normal admin checks. An authenticated user with only the Subscriber role can POST directly to /wp-admin/admin-ajax.php with a valid nonce and create a campaign post with themselves as the author. The nonce is publicly rendered on the submission form for any logged-in user, eliminating CSRF as a barrier. The vulnerability was fixed in version 2.2.1.

## Affected products

- WP Crowdfunding WP Crowdfunding before 2.2.1

## Timeline

- 2026-08-10: disclosed
- 2026-08-12: patched: Fixed in version 2.2.1

## References

- [https://wpscan.com/vulnerability/5bc0f382-7655-4f19-a057-917d49dae6e2/](https://wpscan.com/vulnerability/5bc0f382-7655-4f19-a057-917d49dae6e2/)

## Related threats

- [WP Crowdfunding sensitive data exposure](https://junglewise.ai/threats/cve-2026-118083-unauthenticated-sensitive-data-exposure-in-wp-crowdfunding-2-2-2)
- [WP Crowdfunding stored cross-site scripting in user profile](https://junglewise.ai/threats/cve-2026-19945-wp-crowdfunding-stored-cross-site-scripting-in-user-profile)
- [WP Crowdfunding campaign update modification via insecure direct object reference](https://junglewise.ai/threats/cve-2026-14857-wp-crowdfunding-campaign-update-modification-via-insecure-direct)