SQL Injection Vulnerability in Charitable Donation Plugin for WordPress

CVE-2025-11893

What is CVE-2025-11893?

The Charitable Donation Plugin for WordPress is susceptible to SQL injection through the donation_ids parameter. This vulnerability arises from inadequate user input sanitization and insufficient preparation of existing SQL queries. Authenticated users with Subscriber-level access and upwards can exploit this weakness to append unauthorized SQL queries, potentially compromising sensitive database information. To successfully exploit this vulnerability, attackers are required to perform a paid donation.

References