What is the CVSS score of CVE-2026-10038?

CVE-2026-10038 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Charitable CVE-2026-10038

EUVD-2026-34927 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-06 security@wordfence.com

GHSA-9jf2-67mg-r5ph

Authentication Bypass WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 00:28 vuln.today

CVE Published

Jun 06, 2026 - 00:16 nvd

MEDIUM 4.3

DescriptionCVE.org

The Charitable - Donation Plugin for WordPress - Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Insecure Direct Object Reference / Authorization Bypass leading to Arbitrary Attachment Deletion in versions up to, and including, 1.8.11.1 via the profile avatar update flow. This is due to the save_avatar() function in Charitable_Profile_Form calling wp_delete_attachment() on an attachment ID read from the user's 'avatar' meta without validating that the attachment is owned by the user, combined with Charitable_Data_Processor::process_picture() returning the raw posted value when no file is uploaded, allowing the 'avatar' user meta to be poisoned with any attacker-chosen attachment ID. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary attachments from the Media Library by performing a two-request chain (first poisoning the stored avatar meta value with a target attachment ID, then triggering deletion via a normal avatar upload).

AnalysisAI

Arbitrary Media Library attachment deletion in the Charitable donation plugin for WordPress (versions through 1.8.11.1) is achievable by any authenticated user with Subscriber-level access or above via a two-stage IDOR exploit chain in the profile avatar update flow. The attack chains two weak points: Charitable_Data_Processor::process_picture() returns a raw user-supplied attachment ID verbatim when no file is uploaded, allowing an attacker to poison their own avatar user meta with any arbitrary attachment ID, which save_avatar() then blindly passes to wp_delete_attachment() without verifying that the target attachment belongs to the requesting user. No public exploit has been identified at time of analysis, and exploitation is constrained to authenticated users on sites with active user registration.

Technical ContextAI

CWE-639 (Authorization Through User-Controlled Key) precisely describes the root cause: the plugin uses an attachment ID as an authorization key, but the ID is supplied by the user and never validated against ownership. The vulnerable code path spans two PHP classes within the Charitable plugin: Charitable_Data_Processor::process_picture() (class-charitable-data-processor.php, line 270) performs no ownership check when no file is uploaded and simply returns the posted value, and Charitable_Profile_Form::save_avatar() (class-charitable-profile-form.php, lines 724/728) reads the 'avatar' user meta and passes the stored ID directly to WordPress core's wp_delete_attachment() (class-charitable-user.php, line 986). The WordPress wp_delete_attachment() function itself is a privileged operation not gated by the plugin's authorization layer. Because WordPress grants Subscriber-level users access to the profile form, any registered user can initiate this chain. The attack is two-request: the first request poisons the avatar meta; the second request (a normal avatar upload trigger) activates deletion.

RemediationAI

An upstream fix has been committed to the Charitable plugin trunk on WordPress Trac via changeset 3557047, modifying class-charitable-profile-form.php to enforce attachment ownership validation before calling wp_delete_attachment(). The exact released patched version number is not independently confirmed from the available input data - site administrators should update to the latest available version of the Charitable plugin through the WordPress plugin repository and verify the version exceeds 1.8.11.1. If an immediate update is not possible, the most targeted compensating control is to disable frontend user registration entirely (WordPress Settings > General > uncheck 'Anyone can register'), which removes the Subscriber account prerequisite and makes the attack chain non-executable. A secondary workaround is to restrict avatar upload functionality within the plugin's profile form settings if the feature is not required, preventing the trigger mechanism from firing. Note that disabling registration may impact fundraiser campaign participant flows if Charitable is used for donor account creation.