What is the CVSS score of CVE-2026-7619?

CVE-2026-7619 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Charitable WordPress Plugin CVE-2026-7619

EUVD-2026-29900 MEDIUM

SQL Injection (CWE-89)

2026-05-13 Wordfence

SQLi WordPress

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 13, 2026 - 05:30 vuln.today

CVE Published

May 13, 2026 - 04:26 nvd

MEDIUM 6.5

DescriptionCVE.org

The Charitable - Donation Plugin for WordPress - Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 1.8.10.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with access to the donation management admin area (requiring the edit_others_donations capability) and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

SQL injection in Charitable - Donation Plugin for WordPress versions up to 1.8.10.4 allows authenticated users with donation management admin privileges to inject malicious SQL via the 's' search parameter, enabling extraction of sensitive database information. The vulnerability stems from insufficient escaping and lack of prepared statement usage in the donation search functionality. Attack requires administrator-level access to the donation management area (edit_others_donations capability), limiting scope to internal threats but carrying high confidentiality impact.

Technical ContextAI

The vulnerability exists in the donation search and filtering functionality of the Charitable plugin, specifically in the handling of the 's' parameter used for searching donations. The plugin fails to properly escape or prepare user input before incorporating it into SQL queries, violating SQL injection prevention best practices outlined in CWE-89. WordPress provides the $wpdb->prepare() method for safe parameterized queries, but the vulnerable code path bypasses this protection. The affected code is located in class-charitable-donations.php and class-charitable-donation-list-table.php, which handle donation data retrieval and admin interface display. Without parameterized queries or sufficient input validation, an attacker can append arbitrary SQL syntax to manipulate query logic and extract database contents beyond the intended scope.

RemediationAI

Update Charitable - Donation Plugin for WordPress to the patched version released after 1.8.10.4 immediately. WordPress administrators must navigate to Plugins → Installed Plugins, locate Charitable, and click Update if available. If a specific patched version number is not yet published, monitor the official WordPress plugin page (plugins.wordpress.org/charitable) or Wordfence threat intelligence for the next stable release. As a temporary mitigation for sites unable to update immediately, restrict the edit_others_donations capability to only trusted administrators by using a role management plugin (e.g., User Role Editor) and audit which users currently possess this capability via wp-admin/users.php. Additionally, implement database activity logging via a WordPress security plugin (e.g., Wordfence Premium, Sucuri) to detect and alert on unusual SQL queries from the admin interface. Note that these workarounds do not prevent exploitation by authenticated admins - patching remains the only complete remediation. After patching, review WordPress audit logs and database query logs for evidence of prior exploitation, particularly searches in the donation admin area with suspicious characters (quotes, semicolons, SQL keywords).