Description

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-12T06:17:47.537Z",
  "pubdate": "2026-08-12T06:17:47.537Z",
  "executiveSummary": "An Insecure Direct Object Reference (IDOR) vulnerability exists in the WP Crowdfunding WordPress plugin prior to version 2.2.1. The flaw resides within the order processing component, which fails to cryptographically or logically verify order ownership prior to returning sensitive order details to the requester. This security deficit allows any authenticated user, including low-privileged roles such as Subscribers, to query and retrieve comprehensive personal data associated with arbitrary WooCommerce orders residing within the target database. Consequently, malicious actors can perform exhaustive enumeration attacks against the order repository, harvesting personally identifiable information (PII), financial transaction details, and customer records. The risk implication is significant due to the exposure of confidential customer data and potential compliance violations, requiring only basic authentication and standard HTTP requests to execute successfully without complex exploitation prerequisites.",
  "technicalDetails": "The vulnerability stems from improper access control enforcement within the order detail retrieval functionality of the WP Crowdfunding WordPress plugin. Specifically, when an order details request is processed by the backend component, the application accepts user-supplied order identifiers without validating whether the currently authenticated session possesses administrative privileges or ownership rights over the requested resource. Because the authorization check is omitted, any user possessing a valid authenticated session, even one restricted to the lowest default privilege level such as a Subscriber, can manipulate the order identifier parameter to access unauthorized records. The attack flow begins with the malicious actor authenticating to the WordPress instance to obtain a valid session cookie or token. Following authentication, the attacker crafts direct HTTP requests containing sequential or targeted order IDs. Upon receiving the payload, the vulnerable endpoint queries the underlying database for the specified WooCommerce order data and returns the complete record directly to the client interface. The response typically exposes sensitive data fields, including customer names, billing and shipping addresses, email addresses, phone numbers, and purchased item metadata. Because the application processes these requests without enforcing context-aware access controls, an attacker can script an automated enumeration loop to systematically iterate through all valid order IDs present in the store database, resulting in a mass data breach of transactional records. The affected versions include all releases of the WP Crowdfunding plugin prior to version 2.2.1, operating within a standard network-exposed WordPress environment utilizing WooCommerce for e-commerce and order management."
}