CVE-2026-10038

MediumCVSS 4.3

Published: 06/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

The Charitable – Donation Plugin for WordPress up to version 1.8.11.1 contains an Insecure Direct Object Reference (IDOR) vulnerability in the profile avatar update flow. The save_avatar() function deletes an attachment based on ID from the 'avatar' meta without ownership verification, and process_picture() returns raw values, allowing meta poisoning and arbitrary attachment deletion. Attack requires Subscriber-level access or higher.

Risk Assessment

An attacker can delete arbitrary attachments from the Media Library, potentially leading to loss of important files including images, documents, and other site resources.

Recommendation

Immediately update the Charitable plugin to the latest version and restrict user permissions.

Other vulnerabilities in Charitable – Donation Plugin

CVE-2025-11893Medium
The Charitable – Donation Plugin for WordPress is vulnerable to SQL Injection via the donation_ids parameter in all versions up to, and including, 1.8.8.4 due to insufficient escaping and lack of preparation on the SQL query. This allows authenticated attackers with Subscriber-level access and above to append additional SQL queries to extract sensitive information. Exploitation requires a paid donation.

Original NVD description (English source)

The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Insecure Direct Object Reference / Authorization Bypass leading to Arbitrary Attachment Deletion in versions up to, and including, 1.8.11.1 via the profile avatar update flow. This is due to the save_avatar() function in Charitable_Profile_Form calling wp_delete_attachment() on an attachment ID read from the user's 'avatar' meta without validating that the attachment is owned by the user, combined with Charitable_Data_Processor::process_picture() returning the raw posted value when no file is uploaded, allowing the 'avatar' user meta to be poisoned with any attacker-chosen attachment ID. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary attachments from the Media Library by performing a two-request chain (first poisoning the stored avatar meta value with a target attachment ID, then triggering deletion via a normal avatar upload).

Vulnerability data from NVD (NIST) · CISA KEV · EPSS