CVE-2026-19944 is a SQL Injection vulnerability in the WP Crowdfunding WordPress plugin affecting versions up to 2.2.1. The issue arises from insufficient escaping and lack of proper preparation of user-supplied input in the 'wpneo_reward' Post Meta parameter. Authenticated attackers with shop manager privileges can inject additional SQL queries through the WooCommerce REST API endpoint for products. This is a second-order injection where the malicious payload is stored and executed later on public page views that display the campaign rewards sidebar, enabling unauthorized data extraction from the database.

An attacker with shop manager-level access can exploit this vulnerability to extract sensitive information from the database by injecting SQL queries that execute on public page views. The vulnerability does not allow privilege escalation or denial of service but compromises confidentiality of data. The CVSS score of 4.9 reflects a medium severity with network attack vector, low attack complexity, and high privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict shop manager-level access to trusted users only and monitor for suspicious activity related to the WooCommerce REST API. Avoid exposing the vulnerable plugin on public-facing sites if possible.