EUVD-2026-65324
GHSA-gf56-fg73-x7m8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site with Total Donations
-
DeliverySend crafted request with injected SQL
-
ExploitAppend UNION query to unprepared statement
-
ExecutionExtract credentials and secrets from database
-
ImpactReuse hashes/keys for admin takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only that the Total Donations plugin (version ≤ 2.0.5) be installed and active on a network-reachable WordPress site, with the vulnerable request handler exposed - the default posture for a public WordPress installation. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no special configuration, and no user interaction are needed: this is remote unauthenticated exploitation against default configurations of the Total Donations plugin. The primary limiting factor is simply whether the plugin is installed and active; sites that have removed or deactivated it are not exposed. |
| Impact | The signals point to a genuine high priority rather than an inflated CVSS. The CVSS vector (AV:N/AC:L/PR:N/UI:N) is internally consistent with the description: remote, low-complexity, unauthenticated exploitation with no user interaction, which is the classic profile of an internet-reachable SQLi. Confidentiality impact is well-supported (data extraction is explicitly stated); the vector's I:H/A:H are plausible for SQLi but the description emphasizes information disclosure, so the integrity/availability ratings are somewhat generous relative to the stated behavior. No EPSS score, KEV listing, or POC was provided, so real-world exploitation frequency is unquantified - the absence of an exploit is not evidence of safety, since unauthenticated WordPress plugin SQLi is routinely mass-scanned and commoditized by automated tooling. Any operator running the plugin should treat this as urgent regardless of organization size. Overall: real priority, driven by the unauthenticated network vector and sensitivity of WordPress database contents. |
| Exploit ScenarioDerived | An attacker discovers a WordPress site running Total Donations and sends a crafted HTTP request that appends a UNION-based sub-query to the vulnerable, unprepared parameter. With no authentication or user interaction required, the injected query returns admin password hashes and secret keys directly in the response, which the attacker then cracks or replays to take over the site. No public exploit is identified at time of analysis, but the low-complexity unauthenticated vector makes weaponization straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 25, 2026
SQL injection in the Total Donations WordPress plugin (all versions through 2.0.5) lets unauthenticated remote attackers inject additional SQL into existing queries to read arbitrary database contents, including user credentials and secrets. The flaw stems from an unescaped, unprepared user-supplied parameter and carries a 9.8 CVSS. No public exploit has been identified at time of analysis, but the unauthenticated network vector makes this a high-priority patching target for any site still running the plugin.
RemediationAI
No vendor-released patch version is identified in the available data, so a specific upgrade target cannot be confirmed - the input only establishes that all versions through 2.0.5 are affected. Treat the plugin as unpatched until the vendor advisory (via the Wordfence and Patchstack references above) confirms a fixed release, and if a patched version is published, upgrade to it immediately. Because Total Donations is a historically abandonment-prone commercial plugin, the safest compensating control is to deactivate and remove the plugin entirely if the donation functionality is non-essential; the trade-off is loss of that feature. If it must remain active, place a WAF/virtual patch in front of the site to block SQL-injection payloads on the vulnerable endpoint (Wordfence provides such rules), restrict access to the affected request handler, and rotate database and admin credentials plus WordPress salts on the assumption that prior extraction may have occurred. Monitor query logs for UNION/error-based injection patterns.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Total Donations plugin (CPE cpe:2.3:a:klbtheme:total_donations) for WordPress, a donation/fundraising extension. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): a request parameter is concatenated into a SQL statement without escaping and without using WordPress's prepared-statement API ($wpdb->prepare). Because the query is not parameterized, attacker-controlled input is interpreted as SQL syntax, enabling appended sub-queries (e.g., UNION-based extraction) against the WordPress database, which stores user accounts, password hashes, session/nonce material, and site secrets.
Know when Total Donations gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated low-complexity network SQLi with data extraction gives C:H; description centers on reading data, so integrity is limited (I:L) and availability impact is not indicated (A:N).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Total Donations plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Articles & Coverage 1
Executive ViewAI
The Total Donations WordPress plugin (all versions through 2.0.5) contains a critical SQL injection vulnerability accessible to unauthenticated attackers, placing any WordPress site using this plugin at immediate risk of data breach. Exploitation could expose user credentials, sensitive secrets, and customer payment information stored in the database, enabling account takeover and further network compromise. The absence of available patches makes rapid remediation essential.
Immediately disable or remove the Total Donations plugin from all affected systems. Deploy WAF rules to detect and block SQL injection payloads targeting the plugin endpoints. Implement database-level protections including principle-of-least-privilege user accounts, comprehensive audit logging, and real-time alerts for suspicious queries or failed authentication attempts. If the plugin must remain in use, implement prepared statements and input validation at the code level and restrict database access to backup and monitoring systems only during non-business hours.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Total Donations
View allIncorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for Wor
Privilege escalation in the Total Donations WordPress plugin (all versions through 2.0.5) lets unauthenticated attackers
Privilege escalation in the Total Donations WordPress plugin (versions 2.0.5 and earlier) lets a remote, unauthenticated
Unauthenticated SQL injection in the Total Donations WordPress plugin (versions <= 2.0.5) lets remote attackers inject a
Stored cross-site scripting in the KlbTheme Total Donations WordPress plugin affects versions up to and including 2.0.5
Exploit-DB