PT-2026-40564 · WordPress · The Charitable – Donation Plugin

Abi Wiranata · Published 2026-05-13 · Updated 2026-05-13 · CVE-2026-7619

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Charitable – Donation Plugin for WordPress versions prior to 1.8.10.5

Description The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress contains a generic SQL Injection flaw. This issue occurs due to insufficient escaping of user-supplied parameters and a lack of proper preparation of the SQL query. Authenticated attackers with access to the donation management admin area and the edit others donations capability can append additional SQL queries via the s parameter to extract sensitive information from the database.

Recommendations Update to a version later than 1.8.10.4. As a temporary workaround, restrict access to the donation management admin area to only highly trusted users to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-7619

Affected Products

The Charitable – Donation Plugin

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-7619 · Security Note
• https://plugins.trac.wordpress.org/browser/charitable/trunk/includes/donations/class-charitable-donations.php#L89 · Note
• https://plugins.trac.wordpress.org/browser/charitable/trunk/includes/admin/donations/class-charitable-donation-list-table.php#L837 · Note
• https://plugins.trac.wordpress.org/browser/charitable/tags/1.8.9.7/includes/admin/donations/class-charitable-donation-list-table.php#L837 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/950bed9d-8698-4aa0-86a4-fac9e07bb42b?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3529172/charitable/trunk/includes/donations/class-charitable-donations.php?old=3209943&old_path=charitable%2Ftrunk%2Fincludes%2Fdonations%2Fclass-charitable-donations.php · Note
• https://plugins.trac.wordpress.org/browser/charitable/tags/1.8.10.4/includes/donations/class-charitable-donations.php#L89 · Note
• https://t.me/CVEtracker/53604 · Telegram Post
• https://plugins.trac.wordpress.org/browser/charitable/tags/1.8.10.4/includes/admin/donations/class-charitable-donation-list-table.php#L837 · Note
• https://plugins.trac.wordpress.org/browser/charitable/tags/1.8.9.7/includes/donations/class-charitable-donations.php#L89 · Note