CVE-2026-16650
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events in a default configuration, allowing unauthenticated attackers to forge webhook notifications that mark donations as paid without any real payment.
Risk Assessment
The risk includes the possibility of forging donations as paid, which may lead to financial losses and integrity issues.
Recommendation
It is recommended to update the Charitable plugin to version 1.8.12 or later and configure Square webhook signature verification.
Other vulnerabilities in Charitable
See all- CVE-2026-73994High
Unauthenticated Broken Access Control vulnerability in Charitable versions up to 1.8.11.3.
- CVE-2025-15675Medium
The Charitable WordPress plugin before version 1.8.5.3 does not sanitize and escape one of its campaign image text fields before outputting it in an HTML attribute. This allows users with high-privilege campaign-management roles to perform Stored Cross-Site Scripting (XSS) attacks that execute on the front-end campaign page.
Original NVD description (English source)
The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events in a default configuration, allowing unauthenticated attackers to forge webhook notifications that mark donations as paid without any real payment.