What is GHSA-36jj-jw5h-6rp8?

GHSA-36jj-jw5h-6rp8 is a security advisory published by GitHub Security Advisories with Medium severity. The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before...

Which CVE IDs does GHSA-36jj-jw5h-6rp8 cover?

GHSA-36jj-jw5h-6rp8 covers the following CVE IDs: CVE-2026-14858. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-36jj-jw5h-6rp8?

GHSA-36jj-jw5h-6rp8 has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-36jj-jw5h-6rp8MediumCVSS 4.3

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before...

Vendor

GitHub Security Advisories

Published

August 12, 2026

Last Modified

August 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-14858 →

📋 Description

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-14858
https://wpscan.com/vulnerability/59022a2a-29b2-485a-9512-cd0a27b6492b
https://github.com/advisories/GHSA-36jj-jw5h-6rp8