CVE-2025-11893

MediumCVSS 6.5

Published: 25/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.38%

29th percentile - higher than 29% of all known CVEs

Summary

The Charitable – Donation Plugin for WordPress is vulnerable to SQL Injection via the donation_ids parameter in all versions up to, and including, 1.8.8.4 due to insufficient escaping and lack of preparation on the SQL query. This allows authenticated attackers with Subscriber-level access and above to append additional SQL queries to extract sensitive information. Exploitation requires a paid donation.

Risk Assessment

SQL injection can lead to leakage of sensitive data such as user data or financial information. The organization risks data protection and regulatory compliance.

Recommendation

Update the Charitable plugin to the latest patched version. Restrict high-privilege accounts and monitor database activity.

Other vulnerabilities in Charitable Donation Plugin

CVE-2026-10038Medium
The Charitable – Donation Plugin for WordPress up to version 1.8.11.1 contains an Insecure Direct Object Reference (IDOR) vulnerability in the profile avatar update flow. The save_avatar() function deletes an attachment based on ID from the 'avatar' meta without ownership verification, and process_picture() returns raw values, allowing meta poisoning and arbitrary attachment deletion. Attack requires Subscriber-level access or higher.

Original NVD description (English source)

The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to SQL Injection via the donation_ids parameter in all versions up to, and including, 1.8.8.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation of the vulnerability requires a paid donation.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS