Quick answers
- Is CVE-2026-81287 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-81287 being exploited in the wild.
- How severe is CVE-2026-81287?
- High severity, with a CVSS score of 8.5, published 31 August 2026.
- Which products and versions are affected?
- Charitable Charitable <= 1.8.12.1.
- Is there a fix for CVE-2026-81287?
- A patch was published on 2026-08-31: Patch available in version 1.8.12.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-81287 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-81287?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This vulnerability is a SQL injection flaw exploitable by authenticated users with subscriber privileges. The injection point allows attackers to execute arbitrary SQL queries against the WordPress database without requiring administrative access. The attack requires user authentication at the subscriber level; no network-based attack vector without credentials. A successful exploit enables full database compromise: reading sensitive records, modifying transaction data, or deleting critical information. The vulnerability has been patched in version 1.8.12.2; administrators should update immediately.
Affected products
- Charitable Charitable <= 1.8.12.1
Timeline
- 2026-08-31: disclosed
- 2026-08-31: patched: Patch available in version 1.8.12.2