Total Donations CVE-2026-73391

Exploitation requires that the Total Donations plugin (version <= 2.0.5) be installed and active on an internet-reachable WordPress site; the vulnerable request handler must be exposed (typically via WordPress AJAX/REST routing that plugins register for both logged-in and non-logged-in users). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there is no authentication, no privilege, and no user-interaction requirement - remote unauthenticated exploitation against affected installations. The principal limiting factor is deployment scope: only sites running this specific, now-uncommon plugin are exposed, so the condition is presence of the plugin rather than any special server configuration.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, score 9.3) is severe on paper: network-reachable, low complexity, no privileges, no user interaction, with a scope change and high confidentiality impact - a classic unauthenticated data-exfiltration profile. Notably the vector sets I:N and only A:L, meaning the assessed impact is primarily read/disclosure rather than data tampering or full destruction, which is somewhat unusual for SQLi (blind/error-based extraction often still permits write in practice - verify against the actual sink). No EPSS score, KEV status, or POC signal was supplied, so real-world exploitation likelihood cannot be quantified from this data; the absence of KEV means there is no confirmation of active exploitation. Net: treat as a high-priority patch item because unauthenticated SQLi in an internet-facing WordPress plugin is readily automatable once a POC circulates, but note the exploitation-probability signals are missing rather than low.

A remote unauthenticated attacker sends a crafted HTTP request to the vulnerable Total Donations endpoint with a malicious SQL payload in a parameter, causing the plugin to execute attacker-controlled SQL. Using union- or blind-based techniques they extract WordPress user records and password hashes from the database, then attempt offline cracking or session/credential abuse to escalate access. Given AV:N/AC:L/PR:N/UI:N, this requires no login and no victim interaction, making it trivially scriptable if a POC becomes public.