CVE-2026-78568 in Total Donations Plugin
Summary
by MITRE • 08/25/2026
The Total Donations plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/25/2026
The Total Donations plugin, a widely utilized extension within the WordPress ecosystem designed to facilitate charitable contributions and donation tracking, contains a critical security flaw affecting all versions up through 2.0.5. This vulnerability manifests as an Unrestricted Upload of Code with Execute Permissions in some contexts but is primarily characterized here by its potential for SQL Injection attacks. The root cause lies in insufficient input validation and sanitization mechanisms applied to user-supplied parameters before they are incorporated into database queries. Specifically, the application fails to properly escape special characters or utilize prepared statements when handling data from HTTP requests, leaving a direct pathway for malicious actors to manipulate backend logic.
From a technical perspective, this flaw allows unauthenticated attackers to inject arbitrary SQL commands directly into the query structure executed by the underlying MySQL or MariaDB database. Because the parameter is not adequately sanitized, an attacker can append additional SQL statements that are then processed alongside legitimate queries. This capability enables the extraction of sensitive information stored within the WordPress database, including user credentials, session tokens, and potentially administrative access keys. The lack of sufficient preparation on existing SQL queries means that even if basic escaping functions are present elsewhere in the codebase, this specific endpoint remains vulnerable due to inconsistent implementation or oversight during development.
The operational impact of this vulnerability is severe given its unauthenticated nature. Attackers do not need valid credentials to exploit this flaw, significantly lowering the barrier for entry and increasing the likelihood of automated scanning tools detecting and exploiting the issue across large numbers of websites running affected versions. Successful exploitation can lead to full database compromise, resulting in data breaches that expose personally identifiable information (PII) of donors and site administrators. Furthermore, attackers may leverage extracted credentials to escalate privileges within the WordPress environment, potentially gaining administrative control over the entire website infrastructure. This aligns with Common Weakness Enumeration identifier CWE-89, which classifies improper neutralization of special elements used in an SQL command, commonly known as SQL Injection.
In terms of threat modeling and attack patterns, this vulnerability maps directly to MITRE ATT&CK technique T1059.004, specifically the use of SQL commands for unauthorized access or data exfiltration. The ability to append queries suggests potential for blind SQL injection techniques where attackers infer database structure through time-based or error-based responses if direct output is not immediately visible on the page. This underscores the importance of treating all user inputs as untrusted and implementing strict allow-listing strategies rather than relying solely on block-lists or basic escaping functions that may be bypassed using encoding tricks or character set manipulation.
To mitigate this risk, immediate action is required to update the Total Donations plugin to a version newer than 2.0.5 where these input handling mechanisms have been corrected by the developers. Administrators should verify their WordPress installation for any remaining instances of older versions and ensure that automatic updates are enabled if available. In environments where updating is not immediately feasible, implementing Web Application Firewall rules can help detect and block SQL injection payloads targeting this specific endpoint. Additionally, applying principle of least privilege to database accounts used by the web application ensures that even if an injection occurs, the attacker's ability to modify or delete data is restricted. Regular security audits and code reviews focusing on database interaction layers are essential preventive measures against such vulnerabilities in future development cycles.