EUVD-2026-62392
GHSA-qm8v-wgj5-vhrm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated network SQLi with no interaction gives AV:N/AC:L/PR:N/UI:N; database disclosure crossing the WordPress trust boundary yields S:C and C:H, with limited integrity/availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated SQL Injection in Total Donations <= 2.0.5 versions.
AnalysisAI
Unauthenticated SQL injection in the Total Donations WordPress plugin (versions <= 2.0.5) lets remote attackers inject arbitrary SQL via unsanitized input without any authentication, exposing the WordPress database to disclosure. The CVSS 9.3 rating with a changed scope reflects that a successful attacker can read sensitive data (user credentials, PII, donation records) beyond the plugin's own boundary. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the Total Donations plugin (version <= 2.0.5) be installed and active on an internet-reachable WordPress site; the vulnerable request handler must be exposed (typically via WordPress AJAX/REST routing that plugins register for both logged-in and non-logged-in users). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, score 9.3) is severe on paper: network-reachable, low complexity, no privileges, no user interaction, with a scope change and high confidentiality impact - a classic unauthenticated data-exfiltration profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A remote unauthenticated attacker sends a crafted HTTP request to the vulnerable Total Donations endpoint with a malicious SQL payload in a parameter, causing the plugin to execute attacker-controlled SQL. Using union- or blind-based techniques they extract WordPress user records and password hashes from the database, then attempt offline cracking or session/credential abuse to escalate access. … |
| Remediation | No vendor-released patched version is identified at time of analysis for Total Donations <= 2.0.5, and the plugin appears to be abandoned; the primary recommendation is to deactivate and fully remove the plugin from any WordPress installation, since disabling alone may leave exploitable endpoints registered. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all WordPress installations to identify the Total Donations plugin version; immediately disable and remove the plugin from all production sites to eliminate the attack surface. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Total Donations
View allIncorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for Wor
Privilege escalation in the Total Donations WordPress plugin (all versions through 2.0.5) lets unauthenticated attackers
SQL injection in the Total Donations WordPress plugin (all versions through 2.0.5) lets unauthenticated remote attackers
Privilege escalation in the Total Donations WordPress plugin (versions 2.0.5 and earlier) lets a remote, unauthenticated
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today