EUVD-2026-60808
GHSA-mx82-946p-222x
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Network-reachable unauthenticated endpoint with no complexity barrier; high integrity impact from unauthorized data modification; no confidentiality or availability impact applies.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions.
AnalysisAI
Broken access control in the Charitable WordPress donation plugin (versions 1.8.11.3 and earlier) allows unauthenticated remote attackers to perform unauthorized write operations against protected plugin functionality. Classified under CWE-862 (Missing Authorization), the flaw reflects absent or bypassed capability and nonce checks on one or more plugin endpoints, enabling integrity-impacting actions without any credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond a standard WordPress installation with the Charitable plugin active and version 1.8.11.3 or earlier installed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) accurately reflects a high-severity integrity risk: network-reachable, low complexity, requiring no authentication or user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker identifies a WordPress site running Charitable 1.8.11.3 or earlier through passive reconnaissance (e.g., WordPress plugin enumeration via HTTP headers or readme.txt files). The attacker sends a crafted HTTP POST request directly to the vulnerable plugin endpoint - an AJAX action or REST route - without supplying any authentication credentials or nonce, triggering the unguarded code path. … |
| Remediation | Update the Charitable plugin to a version released after 1.8.11.3 via the WordPress plugin dashboard or by downloading directly from the WordPress Plugin Repository. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress installations to identify those running Charitable plugin versions 1.8.11.3 or earlier and assess business criticality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Charitable
View allThe Donation Forms by Charitable plugin for WordPress is vulnerable to privilege escalation in versions up to, and inclu
The Donation Forms by Charitable - Donations Plugin & Fundraising Platform for WordPress plugin for WordPress is vulnera
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Charitable Donatio
Webhook authentication bypass in the Charitable WordPress donation plugin (versions before 1.8.12) allows unauthenticate
Stored Cross-Site Scripting in the Charitable WordPress donation plugin (versions before 1.8.5.3) allows authenticated u
The Charitable - Donation Plugin WordPress plugin before 1.6.51 is affected by an authenticated stored cross-site script
The Charitable - Donation Plugin for WordPress - Fundraising with Recurring Donations & More plugin for WordPress is vul
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today