Executive brief
The Charitable WordPress plugin integrates with Square to process online donations. A flaw in how the plugin validates Square payment notifications allows attackers to forge webhook messages and mark donations as paid without receiving any actual payment. This could result in lost revenue, donation fraud, and reputational damage to nonprofit organizations relying on the plugin.
Technical details
The vulnerability is a webhook signature verification bypass in the Square payment gateway integration. The plugin fails to verify the cryptographic signature of incoming Square webhook events in the default configuration, checking only for the presence of a merchant_id field rather than validating the HMAC signature. An unauthenticated attacker can POST a forged payment.updated event to the webhook listener endpoint (/?charitable-listener=square_core) with arbitrary payment details, causing the plugin to mark a pending donation as completed without any real payment being processed. The vulnerability requires the Square gateway to be active and no webhook signing secret to be configured—the default state until an administrator manually completes webhook setup. The vulnerability was fixed in version 1.8.12.
Affected products
- Charitable Charitable before 1.8.12
Timeline
- 2026-08-14: disclosed
- 2026-08-21: patched: Fixed in version 1.8.12