Junglewise Threat Intelligence

CVE-2026-10038: WPCharitable Charitable Plugin IDOR in profile avatar update

CVE-2026-10038 · Severity: medium · CVSS 4.3 · Published 2026-06-06

Executive brief

A vulnerability in the Charitable donation plugin for WordPress allows registered users to delete files from the website's media library. This plugin is used by organizations to manage fundraising and recurring donations. An attacker with a basic account could use this flaw to remove important images or documents, potentially disrupting the site's appearance or operations.

Technical details

The Charitable plugin for WordPress (up to 1.8.11.1) is vulnerable to an Insecure Direct Object Reference (IDOR) leading to arbitrary attachment deletion. The root cause is located in the `save_avatar()` function of the `Charitable_Profile_Form` class, which calls `wp_delete_attachment()` on an ID retrieved from the user's 'avatar' meta without verifying ownership. An attacker can exploit this by first 'poisoning' their own avatar meta with a target attachment ID via `Charitable_Data_Processor::process_picture()` (which returns raw input when no file is uploaded) and then triggering the deletion flow through a standard avatar update. This requires Subscriber-level authentication or higher.

Affected products

  • WPCharitable Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More up to, and including, 1.8.11.1

Timeline

  • 2026-06-06: disclosed: Initial publication of the CVE record.

References