What is the CVSS score of CVE-2026-3177?

CVE-2026-3177 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-3177

EUVD-2026-19584 MEDIUM

Insufficient Verification of Data Authenticity (CWE-345)

2026-04-07 Wordfence

WordPress Information Disclosure

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 07, 2026 - 08:00 euvd

EUVD-2026-19584

Analysis Generated

Apr 07, 2026 - 08:00 vuln.today

CVE Published

Apr 07, 2026 - 07:40 nvd

MEDIUM 5.3

DescriptionCVE.org

The Charitable - Donation Plugin for WordPress - Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in versions up to, and including, 1.8.9.7. This is due to missing cryptographic verification of incoming Stripe webhook events. This makes it possible for unauthenticated attackers to forge payment_intent.succeeded webhook payloads and mark pending donations as completed without a real payment.

AnalysisAI

Unauthenticated attackers can forge Stripe webhook events in the Charitable donation plugin for WordPress up to version 1.8.9.7, allowing them to mark pending donations as completed without processing actual payments. The plugin fails to cryptographically verify incoming webhook payloads, enabling attackers to manipulate donation records and bypass payment validation. This impacts all WordPress sites using affected versions and could result in financial loss for fundraising organizations.

Technical ContextAI

The vulnerability stems from missing cryptographic verification (CWE-345: Insufficient Verification of Data Authenticity) of Stripe webhook events in the Charitable donation plugin. Stripe webhooks are HTTP POST requests sent to the plugin to notify it of payment events; legitimate webhooks are signed with HMAC-SHA256 using the webhook endpoint's secret key. The plugin processes incoming payment_intent.succeeded events without validating this signature, trusting the webhook source implicitly. This allows attackers to send arbitrary POST requests mimicking webhook payloads without possessing the secret key. The affected product is identified via CPE as Charitable - Donation Plugin for WordPress (vendor: smub, versions up to 1.8.9.7), a WordPress plugin that integrates Stripe payment processing for donation collection.

RemediationAI

Upgrade the Charitable plugin to version 1.8.9.8 or later, which includes cryptographic verification of Stripe webhook signatures. Site administrators should log into their WordPress dashboard, navigate to Plugins > Installed Plugins, and update Charitable to the patched version. The fix is available via the WordPress plugin repository changeset 3485023. Organizations should verify their Stripe webhook configuration after patching to ensure the endpoint secret is correctly set in both Stripe and the plugin settings. Until patched, disable Stripe payment processing in the plugin if possible, or restrict webhook endpoint access via server-level IP allowlisting if the origin of legitimate Stripe webhooks can be isolated.