EUVD-2026-63910
GHSA-r6r4-9w99-4w36
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Webhook is internet-accessible with no authentication or complexity requirements; impact is limited to integrity of payment status records with no confidentiality or availability consequence.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events in a default configuration, allowing unauthenticated attackers to forge webhook notifications that mark donations as paid without any real payment.
AnalysisAI
Webhook authentication bypass in the Charitable WordPress donation plugin (versions before 1.8.12) allows unauthenticated remote attackers to forge Square payment webhook notifications, causing the plugin to record donations as successfully paid without any actual financial transaction occurring. The vulnerability exists in all default configurations where Square is the configured payment gateway, requiring no credentials or user interaction to exploit. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Charitable WordPress plugin must be installed, active, and configured with the Square payment gateway enabled - Square integration is not enabled by default and requires explicit administrator setup including connecting a Square merchant account. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 5.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N correctly reflects low-complexity network exploitation with no authentication required, but the raw score understates the operational and financial integrity risk to organizations relying on the plugin for real donation processing. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker discovers a WordPress site running a vulnerable version of Charitable with Square payment integration enabled - detectable via plugin fingerprinting or public fundraising page enumeration. The attacker crafts an HTTP POST request matching the expected Square webhook payload structure (donation ID, amount, status) and submits it directly to the site's Charitable Square webhook endpoint without any valid Square signature. … |
| Remediation | Vendor-released patch: Charitable 1.8.12. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Charitable
View allThe Donation Forms by Charitable plugin for WordPress is vulnerable to privilege escalation in versions up to, and inclu
The Donation Forms by Charitable - Donations Plugin & Fundraising Platform for WordPress plugin for WordPress is vulnera
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Charitable Donatio
Stored Cross-Site Scripting in the Charitable WordPress donation plugin (versions before 1.8.5.3) allows authenticated u
Broken access control in the Charitable WordPress donation plugin (versions 1.8.11.3 and earlier) allows unauthenticated
The Charitable - Donation Plugin WordPress plugin before 1.6.51 is affected by an authenticated stored cross-site script
The Charitable - Donation Plugin for WordPress - Fundraising with Recurring Donations & More plugin for WordPress is vul
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today