CVE-2026-16650 in Charitable Plugin
Summary
by MITRE • 08/21/2026
The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events in a default configuration, allowing unauthenticated attackers to forge webhook notifications that mark donations as paid without any real payment.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified in versions of the Charitable WordPress plugin prior to release 1.8.12 represents a critical failure in input validation and cryptographic verification within the application's integration with external payment processing services. Specifically, the flaw resides in the handling of webhook notifications sent by Square, a widely used online payment platform. Webhooks are automated messages sent from an application when specific events take place, such as a successful transaction or a failed charge. In this context, Square sends these webhooks to the WordPress site to inform it that a donation has been successfully processed and paid for. The core technical deficiency is the absence of signature verification mechanisms in the default configuration, which means the plugin accepts incoming webhook requests without confirming their origin or integrity. This lack of authentication allows any actor on the internet to simulate a legitimate payment event by sending a crafted HTTP POST request that mimics the structure of a valid Square webhook payload.
From an operational perspective, this vulnerability enables unauthenticated attackers to forge donation records with significant financial and reputational consequences for organizations relying on the plugin. By submitting falsified webhook data, an attacker can trick the system into marking a donation as completed even though no actual funds were transferred from the donor's account. This results in inflated revenue reports that do not reflect real cash flow, potentially leading to misallocation of resources or incorrect financial planning by charity administrators. Furthermore, this manipulation undermines trust with donors who may believe their contributions have been processed when they have not, and it creates a false sense of security regarding the organization's fundraising efforts. The ease of exploitation is heightened because no valid authentication credentials are required to trigger this state change, making it accessible to any individual with basic knowledge of HTTP protocols and access to an internet connection.
This vulnerability aligns closely with CWE-347, which describes Improper Verification of Cryptographic Signature, as the application fails to verify that the incoming data was indeed sent by a trusted party using valid cryptographic keys or tokens provided by Square. Additionally, it maps to ATT&CK technique T1565.002, specifically Stored Data Manipulation via Client-Side Injection, although in this case, the manipulation occurs server-side through forged inputs rather than client-side code execution. The attacker effectively performs a form of data injection where they inject false state changes into the application's database by exploiting the trust relationship between the plugin and the payment gateway without establishing that trust properly. This is distinct from simple SQL injection or cross-site scripting, as it relies on logical flaws in business logic rather than syntax errors or script execution vulnerabilities.
Mitigation strategies must focus on implementing robust verification processes for all incoming webhook requests. The immediate remediation involves upgrading to version 1.8.12 of the Charitable plugin, which includes patches that enforce proper signature validation against Square's public keys or shared secrets as per their API documentation. For organizations unable to upgrade immediately due to compatibility constraints with other plugins or custom code modifications, a temporary workaround involves implementing server-side logic to validate webhook signatures using standard cryptographic libraries before processing any donation status updates. It is also advisable to restrict access to the webhook endpoint via IP whitelisting if Square provides static IP ranges for their services, although this should not be relied upon as the sole security control since IP addresses can change or be spoofed in certain network configurations. Regular audits of payment logs and reconciliation with bank statements are recommended to detect any instances where forged webhooks may have already been processed before the vulnerability was patched.