The WP Crowdfunding plugin version prior to 2.2.1 does not verify that an authenticated user owns the order before returning its details. An attacker who can authenticate to the site (for example, an account with the Subscriber role) can request arbitrary order IDs and receive all personal information stored for that order, effectively leaking customer data across the entire store.

All installations of the WP Crowdfunding WordPress plugin that are running a version earlier than 2.2.1 are susceptible. No specific vendor or product variants are enumerated beyond the generic WP Crowdfunding plugin.

The CVSS score is 4.3 and the EPSS score is < 1%, and it is not listed in the CISA KEV catalog. Nonetheless, the ability for any authenticated user to read any order introduces a high risk of data breach. The attack requires only that a user be logged in, which is often trivial in a WordPress environment where many subscribers have read‑only access. Because the flaw arises from an improper access control check, an attacker can enumerate orders by iterating over plausible IDs.