EUVD-2026-65358
GHSA-jc8r-vc53-6jvv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated (PR:N), remote (AV:N), low-complexity (AC:L) role elevation to administrator grants full site control, so C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The Total Donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This makes it possible for unauthenticated attackers to elevate their privileges to that of an adminsitrator.
Articles & Coverage 1
AnalysisAI
Privilege escalation in the Total Donations WordPress plugin (all versions through 2.0.5) lets unauthenticated attackers promote themselves to full administrator, per Wordfence and Patchstack advisories. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates it Critical 9.8 with complete confidentiality, integrity, and availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target must be a WordPress site with the Total Donations plugin (version ≤ 2.0.5) installed and active; the plugin's vulnerable privilege-management endpoint must be reachable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Multiple signals point to real, not merely nominal, priority: the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with S:U and C:H/I:H/A:H, meaning remote, low-complexity, unauthenticated exploitation yielding full site compromise - an administrator account on WordPress is effectively total control of the site. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker discovers a WordPress site running Total Donations and sends a crafted unauthenticated HTTP request to the vulnerable plugin endpoint that manipulates user roles, creating or elevating an account to administrator. With admin access they install a malicious plugin or theme webshell, achieving full remote code execution and site takeover. … |
| Remediation | No vendor-released patch version is identified in the available data - the vulnerability spans all versions through 2.0.5 with no fixed release cited by Wordfence or Patchstack. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all WordPress instances for Total Donations plugin versions 2.0.5 and below; immediately disable or remove the plugin from production environments and notify all stakeholders of the exposure window. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Total Donations
View allIncorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for Wor
SQL injection in the Total Donations WordPress plugin (all versions through 2.0.5) lets unauthenticated remote attackers
Privilege escalation in the Total Donations WordPress plugin (versions 2.0.5 and earlier) lets a remote, unauthenticated
Unauthenticated SQL injection in the Total Donations WordPress plugin (versions <= 2.0.5) lets remote attackers inject a
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today