EUVD-2026-62391
GHSA-gcmv-5j7j-qj9m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessScan for Total Donations plugin
-
DeliverySend crafted unauthenticated request
-
ExploitTrigger improper privilege assignment
-
ExecutionGain administrator access
-
PersistInstall malicious plugin for code execution
-
ImpactFull site takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Privilege assignment review
|
| Exploitation Conditions | Exploitation requires only that the vulnerable Total Donations plugin (<= 2.0.5) is installed and active on a network-reachable WordPress site; the CVSS vector AV:N/AC:L/PR:N/UI:N indicates no authentication, no user interaction, and low complexity against default configurations. The primary limiting factor is simply whether the plugin is present and enabled - sites without Total Donations, or those already updated to a fixed release, are not exposed. No specific non-default setting, platform, or user role is documented as a precondition in the available data. |
| Impact | The signals align toward high real-world risk: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity exploitation with no privileges and no user interaction, and full H/H/H impact yields the 9.8 base score. Offsetting this, there is no public exploit identified, the CVE is absent from CISA KEV, and no EPSS value was provided, so there is no confirmed evidence of active or automated exploitation yet - meaning the score reflects potential rather than observed weaponization. Even so, unauthenticated privilege escalation on internet-facing WordPress is exactly the profile that gets mass-scanned once a PoC appears, so any operator running this plugin - even a small municipal or nonprofit team in legnica hosting a donations page - should treat remediation as urgent rather than routine. The main data gap is patch availability: no fix version was supplied, and Total Donations is a plugin with a history of abandonment, which would worsen risk if no vendor update exists. |
| Exploit ScenarioDerived | An attacker scanning the internet for WordPress sites running Total Donations sends a crafted unauthenticated request to a vulnerable plugin endpoint that assigns privileges, elevating an attacker-controlled context to administrator. With admin access they install a malicious plugin or theme to gain code execution and persistent control of the site. No public exploit is currently identified, but the low-complexity, no-auth vector makes reliable exploitation straightforward once request details are known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Privilege escalation in the Total Donations WordPress plugin (versions 2.0.5 and earlier) lets a remote, unauthenticated attacker improperly assign or elevate account privileges, reported by Patchstack under CVE-2026-73390. Because the flaw needs no authentication and carries full confidentiality/integrity/availability impact (CVSS 9.8), a successful exploit can hand an attacker administrative control over the WordPress site. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
RemediationAI
No vendor-released patch version is identified at time of analysis, so the safest actionable step is to deactivate and remove the Total Donations plugin from any WordPress installation running 2.0.5 or earlier until a confirmed patched release is verified; this removes the vulnerable code path entirely at the cost of losing donation functionality. If the plugin cannot be removed immediately, restrict access to the site's wp-admin and the plugin's AJAX/REST endpoints at the web server or WAF layer (for example block or authenticate requests to admin-ajax.php actions and wp-json routes associated with the plugin), accepting that overly broad rules may break legitimate donation form submissions and require tuning. Review all WordPress user accounts and roles for unexpected administrators created before mitigation, and consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/totaldonations/vulnerability/wordpress-total-donations-plugin-2-0-5-privilege-escalation-vulnerability) and Patchstack's virtual-patching for interim protection.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Total Donations is a commercial WordPress fundraising/donations plugin (CPE cpe:2.3:a:klbtheme:total_donations) that integrates payment and campaign management into a WordPress site. The root cause is CWE-266 (Incorrect Privilege Assignment): the plugin grants a privilege level to a user or request context that should not receive it, typically through an exposed action or endpoint that fails to verify the caller's capability/role before performing a privileged operation. In WordPress plugins this class of bug commonly manifests via unauthenticated AJAX or REST handlers that set roles, capabilities, or option values without a nonce or current_user_can() check, allowing an outsider to obtain administrator-equivalent authority.
Know when Total Donations gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable privilege escalation with no user interaction and low complexity yielding administrator control gives PR:N/UI:N/AC:L and full H/H/H impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Privilege Escalation in Total Donations <= 2.0.5 versions.
Executive ViewAI
The Total Donations WordPress plugin (version 2.0.5 and earlier) contains a critical vulnerability allowing remote attackers to gain complete administrative control over affected WordPress sites without authentication. Any organization running this plugin faces immediate risk of data theft, website manipulation, and malware installation. With no vendor patch currently available, immediate remediation is essential.
No vendor-released patch identified at time of analysis. Interim protections include: (1) disable and remove the plugin from production; (2) if retention is necessary, restrict WordPress admin panel access via IP allowlisting and implement Web Application Firewall rules against privilege escalation patterns; (3) enable comprehensive logging of user account modifications; (4) maintain tested offline backups for rapid recovery; (5) monitor vendor advisories and security alerts for patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Total Donations
View allIncorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for Wor
Privilege escalation in the Total Donations WordPress plugin (all versions through 2.0.5) lets unauthenticated attackers
SQL injection in the Total Donations WordPress plugin (all versions through 2.0.5) lets unauthenticated remote attackers
Unauthenticated SQL injection in the Total Donations WordPress plugin (versions <= 2.0.5) lets remote attackers inject a
Stored cross-site scripting in the KlbTheme Total Donations WordPress plugin affects versions up to and including 2.0.5
Exploit-DB