What the vulnerability does
01Description
A vulnerability was found in wp-donate Plugin up to 1.4 on WordPress. It has been classified as critical. This affects an unknown part of the file includes/donate-display.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. Upgrading to version 1.5 is able to address this issue. The identifier of the patch is 019114cb788d954c5d1b36d6c62418619e93a757. It is recommended to upgrade the affected component. The identifier VDB-234249 was assigned to this vulnerability.
Explanation of Vulnerability in Simple Terms
02Summary
The wp-donate plugin contains a SQL injection vulnerability in versions 1.0 and earlier. An authenticated user with low privileges can inject malicious SQL code through unfiltered input, potentially reading, modifying, or deleting database records. The vulnerability requires a valid WordPress account but no additional user interaction.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete data from the site's database using SQL injection.
Potential impact on your site
04Site Impact
Database contents may be exposed, altered, or deleted; site functionality could be disrupted or data compromised.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor role).
Key dates
06Disclosure timeline
July 18, 2023
CVE published
August 6, 2024
Record updated
