EUVD-2026-68777
GHSA-g4wq-78hx-jg9v
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Network-accessible, low-complexity SQLi requiring only subscriber auth; scope change reflects cross-table database read beyond the plugin; no write impact observed.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Subscriber SQL Injection in Charitable <= 1.8.12.1 versions.
AnalysisAI
SQL injection in the Charitable WordPress donation plugin (versions <= 1.8.12.1) allows authenticated subscriber-level users to query the underlying database beyond the plugin's own data scope, yielding high confidentiality impact with scope change. The vulnerability requires only a low-privilege WordPress account, which on sites permitting public user registration is trivially obtainable. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress subscriber account on the target site - the lowest user role, which is freely self-registerable on any WordPress installation with open registration enabled (a common default). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.5 is driven primarily by network accessibility (AV:N), low privilege requirement (PR:L), no user interaction (UI:N), scope change (S:C), and high confidentiality impact (C:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Charitable plugin to a version above 1.8.12.1 via the WordPress admin dashboard or WP-CLI (wp plugin update charitable). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all WordPress installations to identify running versions of Charitable plugin 1.8.12.1 or earlier. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Charitable
View allThe Donation Forms by Charitable plugin for WordPress is vulnerable to privilege escalation in versions up to, and inclu
The Donation Forms by Charitable - Donations Plugin & Fundraising Platform for WordPress plugin for WordPress is vulnera
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Charitable Donatio
Webhook authentication bypass in the Charitable WordPress donation plugin (versions before 1.8.12) allows unauthenticate
Stored Cross-Site Scripting in the Charitable WordPress donation plugin (versions before 1.8.5.3) allows authenticated u
Broken access control in the Charitable WordPress donation plugin (versions 1.8.11.3 and earlier) allows unauthenticated
The Charitable - Donation Plugin WordPress plugin before 1.6.51 is affected by an authenticated stored cross-site script
The Charitable - Donation Plugin for WordPress - Fundraising with Recurring Donations & More plugin for WordPress is vul
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today