{"id":"CVE-2026-118083","kind":"vulnerability","aliases":["CVE-2026-118083"],"related":[],"title":"WP Crowdfunding WordPress plugin exposes sensitive data without login","description":"Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions.","summary":"WP Crowdfunding, a WordPress plugin, versions up to and including 2.2.2 expose sensitive data to unauthenticated visitors. An attacker can read that data without an account.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wordpress","wp-crowdfunding"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the WP Crowdfunding plugin in the WordPress admin under Plugins; unknown whether a specific file or setting is the exposed path.\n- Compare the installed version against `2.2.2`.","fix":"- Move the WP Crowdfunding plugin to a version later than `2.2.2`; the sources do not name the fixed version.","status":"open","published_at":"2026-10-29T16:18:03+00:00","first_seen_at":"2026-10-29T16:25:57+00:00","triaged_at":"2026-10-29T16:29:42+00:00","updated_at":"2026-10-29T16:29:42+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T16:29:42Z","model":"claude-haiku-5-5","output":{"fix":"- Move the WP Crowdfunding plugin to a version later than `2.2.2`; the sources do not name the fixed version.","reach":"internet","title":"WP Crowdfunding WordPress plugin exposes sensitive data without login","impact":"medium","summary":"WP Crowdfunding, a WordPress plugin, versions up to and including 2.2.2 expose sensitive data to unauthenticated visitors. An attacker can read that data without an account.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-crowdfunding"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated visitors read sensitive site data","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-118083 for the exposed data, the affected endpoint and the fixed version.","how_to_check":"- Check the installed version of the WP Crowdfunding plugin in the WordPress admin under Plugins; unknown whether a specific file or setting is the exposed path.\n- Compare the installed version against `2.2.2`.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WP Crowdfunding WordPress plugin at version 2.2.2 or earlier. The sources do not say which data is exposed or which endpoint leaks it, so unknown whether a site without crowdfunding features enabled is affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000689,"input_tokens":4066,"output_tokens":564,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118083':12A,15A '-2026':11A,14A '2.2.2':31B,54C 'account':46B 'attack':39B 'crowdfund':2A,20B,22B,53C 'cve':10A,13A 'data':7A,34B,43B,49C 'expos':5A,32B 'exposur':50C 'includ':30B 'login':9A 'packag':16B 'plugin':4A,25B 'read':41B 'sensit':6A,33B,48C 'unauthent':36B,47C 'version':26B,55C 'visitor':37B 'without':8A,44B 'wordpress':3A,17B,24B 'wp':1A,19B,21B,52C 'wp-crowdfund':18B","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Crowdfunding WordPress plugin at version 2.2.2 or earlier. The sources do not say which data is exposed or which endpoint leaks it, so unknown whether a site without crowdfunding features enabled is affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118083","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118083","severity":null,"published_at":"2026-10-29T16:18:03+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:25:57+00:00","fetched_at":"2026-10-29T16:25:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}