Total Donations CVE-2026-78570

The target must be a WordPress site with the Total Donations plugin (version ≤ 2.0.5) installed and active; the plugin's vulnerable privilege-management endpoint must be reachable. Per the CVSS vector AV:N/AC:L/PR:N/UI:N there are no special conditions - remote unauthenticated exploitation is possible against default configurations of Total Donations, with no authentication, no user interaction, and no non-default setting required. The primary limiting factor is simply whether the plugin is installed and network-accessible; sites not running this plugin are unaffected.

Multiple signals point to real, not merely nominal, priority: the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with S:U and C:H/I:H/A:H, meaning remote, low-complexity, unauthenticated exploitation yielding full site compromise - an administrator account on WordPress is effectively total control of the site. Counterbalancing signals are thinner: there is no CISA KEV listing (not confirmed as actively exploited) and no public exploit code identified at time of analysis, and no EPSS score was supplied, so the probabilistic exploitation likelihood cannot be quantified from the input. The absence of KEV/POC data lowers immediate certainty of mass exploitation, but does not reduce the intrinsic severity: unauthenticated privilege-escalation-to-admin bugs in WordPress plugins are historically prime targets for automated campaigns once details circulate, so operators running this plugin should treat it as urgent and patch- or removal-driven remediation should not wait for POC confirmation. No SSVC decision data was provided in the input, so automatable/technical-impact framing is inferred from the CVSS vector rather than a formal vendor SSVC assessment.

An attacker discovers a WordPress site running Total Donations and sends a crafted unauthenticated HTTP request to the vulnerable plugin endpoint that manipulates user roles, creating or elevating an account to administrator. With admin access they install a malicious plugin or theme webshell, achieving full remote code execution and site takeover. The low attack complexity and lack of required authentication or user interaction make this trivially scriptable, though no public POC is identified at time of analysis.