CVE-2023-41870 is a medium severity (CVSS 4.3) missing authorization flaw in WP Crowdfunding, a WordPress plugin from Themeum, in versions through 2.1.5. Patchstack lists 2.1.6 as the patched version. Update the plugin and check which roles can use its features on your sites.
What's affected
The NVD record says WP Crowdfunding is affected "from n/a through 2.1.5". Patchstack, which we read, agrees and lists 2.1.6 as the patched version with a low priority label and CVSS 4.3.
The record describes the issue as exploiting incorrectly configured access control security levels. In practice that means an action was open to users who should not have it.
The record scores the flaw 4.3 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. It can be reached over the network, the attack complexity is low, it requires low privileges, and it needs no user interaction. The impact on confidentiality is no, on integrity no and on availability low. The weakness class is CWE-862 (missing authorization). The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
Check the plugin version on every WordPress site you run. If you have WP-CLI access:
wp plugin get wp-crowdfunding --fields=name,status,version
Or open Plugins in the dashboard and read the version under WP Crowdfunding. Anything at or below 2.1.5 is in the affected range. Patchstack lists 2.1.6 as the patched version. Do not forget staging copies and rarely visited sites, and remove plugins you no longer use.
What to do now
- Update WP Crowdfunding to 2.1.6 or later. With WP-CLI:
wp plugin update wp-crowdfunding. - Review which user roles exist on each site and remove accounts that are not needed.
- Test crowdfunding flows on a staging copy after the update.
Why it matters
The weakness is CWE-862, missing authorization. The vector shows low privileges are needed, no user interaction, and the impact is on availability only. So the realistic worry is a low privileged account disrupting a feature.
The lesson for plugin heavy sites is about account hygiene. Many broken access control bugs only matter if an attacker already has some account, so fewer accounts means less exposure. It also helps to remove plugins you no longer use, since an unused plugin is exposure with no benefit, and to keep a list of plugin slugs and versions so you can answer quickly when an advisory lands.
Quick check
What does the flaw affect?
The vector shows a low availability impact and no confidentiality or integrity impact.
What is the fixed version?
Patchstack lists 2.1.6. The record says versions through 2.1.5 are affected.
Sources
Last reviewed: 19 October 2026.
