Charitable EUVD-2026-68777

Exploitation requires a valid WordPress subscriber account on the target site - the lowest user role, which is freely self-registerable on any WordPress installation with open registration enabled (a common default). The Charitable plugin must be installed and active at version 1.8.12.1 or earlier. No additional plugin configuration or non-default feature flag is required. Exploitation is limited to sites where user registration is enabled; sites that disable public registration or restrict access to authenticated internal users only face meaningfully reduced risk. The read-oriented nature of the injection (I:N in CVSS) limits write-based impact such as account takeover via direct credential modification.

The CVSS 3.1 score of 8.5 is driven primarily by network accessibility (AV:N), low privilege requirement (PR:L), no user interaction (UI:N), scope change (S:C), and high confidentiality impact (C:H). The scope change is the most significant amplifier: data extractable likely includes WordPress user table hashes and site configuration, not merely plugin-level records. The absence of integrity impact (I:N) and only low availability impact (A:L) suggests a read-oriented injection rather than a destructive one. EPSS data is not provided; KEV status is not listed, and no POC has been identified in the supplied data, so active exploitation is unconfirmed. Despite the lack of confirmed exploitation, the low access requirement is a practical concern: WordPress subscriber accounts are self-registerable on a large proportion of sites. Real-world priority is elevated for donation-processing sites that store donor PII or link to payment records.

An attacker visits a charity or nonprofit WordPress site, self-registers for a free subscriber account, and then submits a crafted HTTP request to the vulnerable Charitable plugin endpoint embedding a UNION-based SQL payload. The injected query traverses into the WordPress wp_users table and extracts hashed passwords and email addresses, which the attacker retrieves in the response. No public proof-of-concept code has been identified at time of analysis, but the low complexity rating suggests this is straightforward to develop from the plugin's source code.