CVE-2026-14857 is an authorization bypass vulnerability in the WP Crowdfunding plugin for WordPress. Versions prior to 2.2.1 do not properly verify that a user owns a campaign before permitting updates to the campaign's update history and triggering notification emails to the campaign's backers. This allows any authenticated user, regardless of their role, to modify other users' campaigns, potentially misleading backers or disrupting campaign integrity. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).

An attacker with any authenticated WordPress user account, including low-privilege Subscriber accounts, can modify the update history of campaigns they do not own. This could lead to unauthorized changes being communicated to campaign backers via notification emails, potentially causing misinformation or reputational damage to legitimate campaign owners.

No official fix or patch has been confirmed as of the published date. Users of WP Crowdfunding should monitor the vendor's advisories for updates and apply any forthcoming patches promptly. Until a fix is available, restricting user roles or limiting authenticated user access may reduce risk, but no vendor advisory currently provides specific mitigation instructions.