What the vulnerability does
01Description
The Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.8.1.14. This is due to the plugin not properly verifying a user's identity when the ID parameter is supplied through the update_core_user() function. This makes it possible for unauthenticated attackers to update the email address and password of arbitrary user accounts, including administrators, which can then be used to log in to those user accounts.
Explanation of Vulnerability in Simple Terms
02Summary
The Charitable donation plugin for WordPress contains a critical vulnerability that allows unauthenticated attackers to read sensitive data, modify site content, and disrupt service without requiring user interaction. The flaw affects all versions up to 1.8.1.14. Site administrators should update immediately to a version newer than 1.8.1.14.
What an attacker can do
03Attacker Capabilities
Read sensitive data, modify content, and disrupt the site without authentication.
Potential impact on your site
04Site Impact
Attackers can steal donor data, alter donation records, and take the site offline.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
September 24, 2024
CVE published
April 8, 2026
Record updated
