EUVD-2026-62391
GHSA-gcmv-5j7j-qj9m
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable privilege escalation with no user interaction and low complexity yielding administrator control gives PR:N/UI:N/AC:L and full H/H/H impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Privilege Escalation in Total Donations <= 2.0.5 versions.
AnalysisAI
Privilege escalation in the Total Donations WordPress plugin (versions 2.0.5 and earlier) lets a remote, unauthenticated attacker improperly assign or elevate account privileges, reported by Patchstack under CVE-2026-73390. Because the flaw needs no authentication and carries full confidentiality/integrity/availability impact (CVSS 9.8), a successful exploit can hand an attacker administrative control over the WordPress site. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only that the vulnerable Total Donations plugin (<= 2.0.5) is installed and active on a network-reachable WordPress site; the CVSS vector AV:N/AC:L/PR:N/UI:N indicates no authentication, no user interaction, and low complexity against default configurations. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals align toward high real-world risk: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity exploitation with no privileges and no user interaction, and full H/H/H impact yields the 9.8 base score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker scanning the internet for WordPress sites running Total Donations sends a crafted unauthenticated request to a vulnerable plugin endpoint that assigns privileges, elevating an attacker-controlled context to administrator. With admin access they install a malicious plugin or theme to gain code execution and persistent control of the site. … |
| Remediation | No vendor-released patch version is identified at time of analysis, so the safest actionable step is to deactivate and remove the Total Donations plugin from any WordPress installation running 2.0.5 or earlier until a confirmed patched release is verified; this removes the vulnerable code path entirely at the cost of losing donation functionality. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress installations using the Total Donations plugin (version 2.0.5 or earlier) and evaluate their business importance. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Total Donations
View allIncorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for Wor
Privilege escalation in the Total Donations WordPress plugin (all versions through 2.0.5) lets unauthenticated attackers
SQL injection in the Total Donations WordPress plugin (all versions through 2.0.5) lets unauthenticated remote attackers
Unauthenticated SQL injection in the Total Donations WordPress plugin (versions <= 2.0.5) lets remote attackers inject a
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today