EUVD-2026-68983
GHSA-65hr-7qjp-r73r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain contributor WordPress account
-
DeliveryCreate draft post with [charitable_donors] shortcode
-
ExploitCraft malicious 'order' parameter payload
-
ExecutionPreview draft to trigger shortcode execution
-
PersistSQL injection appended to donor query
-
ImpactExfiltrate sensitive data from WordPress database
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated WordPress account with contributor-level access or higher (CVSS PR:L). The |
| Impact | The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects the attack profile: network-reachable, low complexity, but requiring at minimum contributor-level WordPress authentication. The PR:L requirement is a meaningful barrier - unauthenticated exploitation is not possible. However, contributor accounts are frequently granted in multi-author WordPress sites (bloggers, guest writers, fundraising volunteers), which narrows but does not eliminate the realistic attacker pool. EPSS data was not provided; given no KEV listing and no reported POC, real-world exploitation risk is moderate rather than urgent. The high confidentiality impact (C:H) is genuine: WordPress donor databases can contain names, addresses, email addresses, and donation histories. Integrity and availability are unaffected (I:N/A:N), consistent with a read-only injection. No conflicting signals exist between CVSS vector and the description - both clearly indicate authenticated, network-based, read-only data exfiltration. |
| Exploit ScenarioDerived | An attacker registers or compromises a contributor-level WordPress account on a site running the Charitable plugin through version 1.8.12.1. They create a draft post containing the |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
SQL Injection in the Charitable donation plugin for WordPress (versions through 1.8.12.1) allows authenticated attackers with contributor-level access to extract sensitive data from the WordPress database. The vulnerability resides in the order shortcode attribute of the [charitable_donors] shortcode, which is reachable by contributors via draft or pending post previews - a low-friction entry point requiring no special site permissions beyond the contributor role. No public exploit code or active KEV-listed exploitation has been identified at time of analysis, but the confidentiality impact is high given that WordPress databases routinely contain PII, donor payment metadata, and user credentials.
RemediationAI
Update the Charitable plugin to a version beyond 1.8.12.1; a fix commit is available in the WordPress plugin SVN repository (changeset 3662994 at https://plugins.trac.wordpress.org/changeset?reponame=&old=3662994%40charitable&new=3662994%40charitable), though the exact released patched version number is not independently confirmed from available data - verify the current version in the WordPress Plugin Directory before updating. As an interim workaround, site administrators can remove contributor-level user accounts or restrict the ability of contributors to create draft or pending posts, which eliminates the accessible entry point for this shortcode. Alternatively, disabling the [charitable_donors] shortcode entirely via a code snippet or plugin management removes the attack surface at the cost of donor listing functionality. Standard WordPress database-level hardening (least-privilege DB user, no FILE or SUPER grants) limits the blast radius of any SQL injection.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) in the Charitable plugin developed by SMUB, identified via CPE cpe:2.3:a:smub:charitable_-_donation_&_fundraising_platform_.... The vulnerable code path runs through abstract-class-charitable-query.php (lines 194 and 443), class-charitable-donor-query.php (line 60), and the shortcode handler class-charitable-donors-shortcode.php (lines 52 and 171), all visible in the WordPress plugin SVN at tag 1.8.12.1. The order parameter passed through the [charitable_donors] shortcode is insufficiently escaped and appended to an existing SQL query without proper preparation, enabling a second-order or inline SQL injection via ORDER BY clause manipulation. WordPress's $wpdb layer provides parameterized query helpers that were not applied here.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible shortcode requires contributor login (PR:L); read-only injection yields high confidentiality but no integrity or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Charitable - Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) plugin for WordPress is vulnerable to generic SQL Injection via 'order' Shortcode Attribute in all versions up to, and including, 1.8.12.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The [charitable_donors] shortcode is accessible to Contributor-level users via draft or pending post previews, providing an authenticated but low-privileged entry point for exploitation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB