Executive brief
The Charitable WordPress plugin, used to build donation and fundraising campaigns, contains a SQL injection vulnerability in its donor list shortcode. An authenticated user with contributor-level access or higher can craft malicious input to extract sensitive data from the site's database, including donor information and financial records.
Technical details
The vulnerability is a generic SQL injection in the [charitable_donors] shortcode's 'order' parameter, affecting all versions through 1.8.12.1. The root cause is insufficient escaping of user-supplied input and lack of parameterized query preparation in the SQL statement. The attack requires authentication (contributor-level access minimum), but the shortcode is accessible to low-privileged users via draft or pending post previews, lowering the barrier to exploitation. An attacker can append arbitrary SQL to extract data from the database. No patch information is currently available.
Affected products
- Charitable Charitable up to and including 1.8.12.1
Timeline
- 2026-09-01: disclosed