What the vulnerability does
01Description
The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in versions up to, and including, 1.8.9.7. This is due to missing cryptographic verification of incoming Stripe webhook events. This makes it possible for unauthenticated attackers to forge payment_intent.succeeded webhook payloads and mark pending donations as completed without a real payment.
Explanation of Vulnerability in Simple Terms
02Summary
The Charitable donation plugin for WordPress contains an integrity vulnerability affecting versions up to 1.8.9.7. An attacker on the network can modify data without authentication or user interaction. The vulnerability has low integrity impact and does not affect confidentiality or availability. Site administrators should update to a version newer than 1.8.9.7.
What an attacker can do
03Attacker Capabilities
Modify data on the site over the network without needing to log in.
Potential impact on your site
04Site Impact
Donation data or plugin settings could be altered by an unauthenticated attacker.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
April 7, 2026
CVE published
April 8, 2026
Record updated
