SQL Injection Vulnerability in Charitable Donation Plugin for WordPress
CVE-2026-7619

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Charitable – Donation Plugin For WordPress – Fundraising With Recurring Donations & More
Vendor
CVE Published:
13 May 2026

What is CVE-2026-7619?

The Charitable – Donation Plugin for WordPress suffers from a SQL Injection vulnerability that allows authenticated attackers to manipulate database queries via the 's' parameter. This issue arises from inadequate escaping of user-supplied input and insufficient preparation of the existing SQL queries. Attackers with access to the donation management admin area can exploit this weakness to inject additional SQL commands, potentially leading to unauthorized access and extraction of sensitive database information.

Affected Version(s)

Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More 0 <= 1.8.10.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/charitable/tru...
https://plugins.trac.wordpress.org/browser/charitable/tag...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abi Wiranata
.