Insecure Direct Object Reference in Charitable Donation Plugin for WordPress

CVE-2026-10038

What is CVE-2026-10038?

The Charitable – Donation Plugin for WordPress is susceptible to an insecure direct object reference and authorization bypass, which allows users with subscriber-level access and above to delete arbitrary attachments from the Media Library. This exploit stems from the mismanagement of the 'avatar' user meta data while updating profile avatars. Specifically, the 'save_avatar()' function fails to validate ownership of the attachment ID read from user meta. Attackers can exploit this flaw by first poisoning the avatar metadata with a targeted attachment ID and subsequently triggering the deletion via a normal avatar upload process. This vulnerability highlights critical security lapses in how user permissions and media access are handled.

References