CVE-2026-77189
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The Charitable plugin for WordPress is vulnerable to generic SQL Injection via 'order' Shortcode Attribute in all versions up to and including 1.8.12.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This allows authenticated attackers with contributor-level access and above to append additional SQL queries into existing queries that can be used to extract sensitive information from the database.
Risk Assessment
An attacker can extract sensitive data from the database, such as passwords, user data, or other confidential information, potentially leading to security breaches.
Recommendation
It is recommended to update the Charitable plugin to the latest available version that includes security fixes.
Other vulnerabilities in Charitable
See all- CVE-2026-81287High
Subscriber SQL Injection in Charitable versions up to 1.8.12.1.
- CVE-2026-16650Medium
The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events in a default configuration, allowing unauthenticated attackers to forge webhook notifications that mark donations as paid without any real payment.
- CVE-2026-73994High
Unauthenticated Broken Access Control vulnerability in Charitable versions up to 1.8.11.3.
- CVE-2025-15675Medium
The Charitable WordPress plugin before version 1.8.5.3 does not sanitize and escape one of its campaign image text fields before outputting it in an HTML attribute. This allows users with high-privilege campaign-management roles to perform Stored Cross-Site Scripting (XSS) attacks that execute on the front-end campaign page.
Original NVD description (English source)
The Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) plugin for WordPress is vulnerable to generic SQL Injection via 'order' Shortcode Attribute in all versions up to, and including, 1.8.12.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The [charitable_donors] shortcode is accessible to Contributor-level users via draft or pending post previews, providing an authenticated but low-privileged entry point for exploitation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS