CVE-2026-77189 in Charitable Plugin
Summary
by MITRE • 09/01/2026
The Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) plugin for WordPress is vulnerable to generic SQL Injection via 'order' Shortcode Attribute in all versions up to, and including, 1.8.12.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The [charitable_donors] shortcode is accessible to Contributor-level users via draft or pending post previews, providing an authenticated but low-privileged entry point for exploitation.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/01/2026
The Charitable plugin for WordPress, a widely utilized solution for managing donation forms, recurring donations, and fundraising campaigns, contains a critical SQL injection vulnerability in versions up to 1.8.12.1. This flaw resides specifically within the handling of the order attribute used by the charitable_donors shortcode. The root cause is insufficient input validation and sanitization on user-supplied parameters that are directly incorporated into database queries without proper escaping or parameterized query preparation. Because WordPress shortcodes allow dynamic content generation based on attributes, an attacker can manipulate these inputs to alter the structure of SQL statements executed against the backend database. This type of vulnerability falls under CWE-89 Improper Neutralization of Special Elements used in an SQL Command, which represents one of the most dangerous web application security risks due to its potential for complete data compromise.
The operational impact of this vulnerability is severe because it allows authenticated attackers with contributor-level access and above to extract sensitive information from the database. While contributor-level privileges are generally considered low-privileged within WordPress, they still grant sufficient access to create posts or drafts that contain malicious shortcodes. The exploitation vector is particularly insidious because it leverages draft or pending post previews. In many WordPress configurations, preview functionality allows users with limited permissions to view content before publication, effectively bypassing the need for public visibility of the compromised page. This provides a reliable and stealthy entry point for attackers who have already gained low-level access through other means, such as credential stuffing or weak password attacks on user accounts.
From an offensive security perspective, this vulnerability aligns with ATT&CK technique T1059 Command and Scripting Interpreter via SQL injection commands, although the primary goal here is data extraction rather than command execution. The attacker can append additional SQL queries to existing ones, potentially retrieving usernames, hashed passwords, email addresses of donors, financial transaction records, and other personally identifiable information stored in the WordPress database. This data exfiltration can lead to further attacks such as identity theft, fraud, or lateral movement within a compromised network if similar credentials are reused elsewhere. The lack of prepared statements means that even simple string concatenation errors allow for complex SQL manipulation techniques including union-based extraction and error-based dumping.
Mitigation strategies must focus on immediate patching and enhanced input handling practices. Administrators should update the Charitable plugin to version 1.8.12.2 or later, where this issue has been addressed through proper sanitization of shortcode attributes and implementation of prepared statements for all database interactions. In environments where updating is not immediately feasible, temporary mitigations include restricting contributor-level access to preview functionality if possible, implementing Web Application Firewall rules that detect SQL injection patterns in query parameters, and enforcing strict role-based access control policies. Long-term remediation should involve adopting secure coding standards such as OWASP Top 10 guidelines for input validation and output encoding, ensuring that all user inputs are treated as untrusted data until explicitly validated against expected formats. Regular security audits and penetration testing of WordPress plugins can help identify similar vulnerabilities in other components before they are exploited in the wild.