Charitable Plugin EUVD-2026-63910

The Charitable WordPress plugin must be installed, active, and configured with the Square payment gateway enabled - Square integration is not enabled by default and requires explicit administrator setup including connecting a Square merchant account. The webhook receiver endpoint must be publicly accessible over the internet, which is its normal operating condition when Square is active. No authentication is required (PR:N per CVSS), no user interaction is needed, and attack complexity is low. Exploitation is limited to sites that have specifically chosen Square as their payment processor within Charitable; sites using only other gateways (Stripe, PayPal, etc.) are not exposed by this specific flaw. Plugin version must be below 1.8.12.

The CVSS 3.1 score of 5.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N correctly reflects low-complexity network exploitation with no authentication required, but the raw score understates the operational and financial integrity risk to organizations relying on the plugin for real donation processing. EPSS data was not provided in the available intelligence. No KEV listing exists, indicating no confirmed widespread active exploitation, but a publicly available proof-of-concept materially increases the realistic exploitation probability beyond what the moderate CVSS score alone implies. The business impact - fraudulent 'paid' donation records - is disproportionate to the CVSS integrity score of 'Low', since even a small charitable organization managing donor records could face significant financial reconciliation burden, donor trust issues, or fraudulent access to donor-gated benefits. Even a mid-sized municipal charitable operator should treat this as urgent patching work given the trivial exploitation requirements and available POC. The vulnerability is constrained to sites using Square as their Charitable payment gateway, which limits the universally exposed population.

An attacker discovers a WordPress site running a vulnerable version of Charitable with Square payment integration enabled - detectable via plugin fingerprinting or public fundraising page enumeration. The attacker crafts an HTTP POST request matching the expected Square webhook payload structure (donation ID, amount, status) and submits it directly to the site's Charitable Square webhook endpoint without any valid Square signature. A publicly available proof-of-concept documents the exact request structure needed. The plugin accepts the forged event and records the targeted donation as paid, potentially granting the attacker access to event registrations, donor acknowledgments, or other fulfillment tied to a completed donation.