Charitable CVE-2026-73994

No special conditions are required beyond a standard WordPress installation with the Charitable plugin active and version 1.8.11.3 or earlier installed. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms the vulnerable endpoint is reachable over the network without authentication and without requiring any user interaction or complex preconditions. Exploitation is limited to integrity impact only - attackers cannot extract sensitive data (C:N) or disrupt availability (A:N). Sites not exposing WordPress AJAX or REST endpoints to the public internet (e.g., behind authenticated reverse proxies) would have reduced exposure, but this is not a default WordPress hardening measure. No specific plugin feature, configuration flag, or non-default setting is cited in the available data as a prerequisite.

The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) accurately reflects a high-severity integrity risk: network-reachable, low complexity, requiring no authentication or user interaction. The Integrity:High impact suggests the flaw allows meaningful unauthorized data modification - likely manipulation of donation records, campaign configurations, or plugin settings. No EPSS score was provided in the source data, so exploitation probability cannot be quantified numerically; however, the combination of PR:N, AC:L, and a popular plugin in the WordPress ecosystem constitutes a favorable attack profile for opportunistic scanning. No KEV listing and no reported public exploit code reduce immediate urgency compared to a fully weaponized flaw, but the low exploitation bar means even a mid-sized municipal IT team in swidnica managing a charity or nonprofit site should treat this as a prompt patching priority rather than a deferred maintenance item. There is no confidentiality or availability impact, which limits the blast radius - this is not a credential-leak or site-takedown class of vulnerability, but unauthorized integrity modification of donation or campaign data can have significant reputational and financial consequences for charitable organizations.

An unauthenticated attacker identifies a WordPress site running Charitable 1.8.11.3 or earlier through passive reconnaissance (e.g., WordPress plugin enumeration via HTTP headers or readme.txt files). The attacker sends a crafted HTTP POST request directly to the vulnerable plugin endpoint - an AJAX action or REST route - without supplying any authentication credentials or nonce, triggering the unguarded code path. The server processes the request and performs the unauthorized operation, potentially modifying donation amounts, campaign details, or plugin configuration data. No public exploit code has been identified at time of analysis, but the low-complexity attack vector is readily reproducible from the vulnerability class alone.