PT-2026-47067 · WordPress · The Charitable – Donation Plugin
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More versions prior to 1.8.11.2
Description
An Insecure Direct Object Reference and Authorization Bypass allows authenticated attackers with Subscriber-level access or higher to delete arbitrary attachments from the Media Library. The issue occurs during the profile avatar update flow because the
save avatar() function in Charitable Profile Form calls wp delete attachment() using an attachment ID from the user's avatar meta without verifying ownership. Additionally, Charitable Data Processor::process picture() returns the raw posted value when no file is uploaded, enabling the avatar user meta to be poisoned with a target attachment ID. Exploitation involves a two-request chain: first poisoning the stored avatar meta value and then triggering the deletion through a standard avatar upload.Recommendations
Update the plugin to version 1.8.11.2 or later.
As a temporary workaround, restrict access to the profile avatar update functionality for users with Subscriber-level permissions.
Fix
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
The Charitable – Donation Plugin