CVE-2026-14858 is an authorization bypass vulnerability in the WP Crowdfunding WordPress plugin prior to version 2.2.1. The plugin does not properly verify that a user owns an order before disclosing order details. This flaw enables any authenticated user, regardless of privilege level, to read personal data associated with any WooCommerce order and to enumerate all orders in the store. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). No CVSS score or vendor advisory is currently available, and no patch or official remediation has been confirmed.

Any authenticated user on a WordPress site using a vulnerable version of WP Crowdfunding can access sensitive personal information from WooCommerce orders they do not own. This exposure risks privacy violations and potential misuse of customer data. Additionally, the ability to enumerate all orders could facilitate further targeted attacks or data harvesting.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user roles to trusted users only and consider disabling or limiting the WP Crowdfunding plugin functionality that exposes order details. Monitor for vendor updates and apply patches promptly once released.