# CVE-2026-16650: Charitable WordPress plugin Square webhook signature bypass

Source: https://junglewise.ai/threats/cve-2026-16650-charitable-wordpress-plugin-square-webhook-signature-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-21. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-16650 · Severity: medium · CVSS 5.3 · Published 2026-08-21

The Charitable WordPress plugin integrates with Square to process online donations. A flaw in how the plugin validates Square payment notifications allows attackers to forge webhook messages and mark donations as paid without receiving any actual payment. This could result in lost revenue, donation fraud, and reputational damage to nonprofit organizations relying on the plugin.

## Quick answers

**Is CVE-2026-16650 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16650 being exploited in the wild.

**How severe is CVE-2026-16650?** Medium severity, with a CVSS score of 5.3, published 21 August 2026.

**Which products and versions are affected?** Charitable Charitable before 1.8.12.

**Is there a fix for CVE-2026-16650?** A patch was published on 2026-08-21: Fixed in version 1.8.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-16650 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-16650?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a webhook signature verification bypass in the Square payment gateway integration. The plugin fails to verify the cryptographic signature of incoming Square webhook events in the default configuration, checking only for the presence of a merchant_id field rather than validating the HMAC signature. An unauthenticated attacker can POST a forged payment.updated event to the webhook listener endpoint (/?charitable-listener=square_core) with arbitrary payment details, causing the plugin to mark a pending donation as completed without any real payment being processed. The vulnerability requires the Square gateway to be active and no webhook signing secret to be configured—the default state until an administrator manually completes webhook setup. The vulnerability was fixed in version 1.8.12.

## Affected products

- Charitable Charitable before 1.8.12

## Timeline

- 2026-08-14: disclosed
- 2026-08-21: patched: Fixed in version 1.8.12

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://wpscan.com/vulnerability/da611bd1-0702-4cdd-b04c-ad7210f78cfe/](https://wpscan.com/vulnerability/da611bd1-0702-4cdd-b04c-ad7210f78cfe/)